Cineplanet Exposes Millions of Records Through Leaky Database

Written by Bill Toulas
Last updated September 25, 2021

Researcher Anurag Sen has recently discovered a non-password-protected Microsoft Azure server containing about 14 million login records and 205 million logs of data. Upon investigating further, the man and his team realized that the owner of the database was Cineplanet, a Peruvian movie theater chain owned by Intercorp Group, and which has been selling tickets online for over eight years now. Since 2018, Cineplanet has also been running a customer loyalty program promoting and selling stuff in combos, and thus they have been retaining people’s personal details for a while now.

The researcher claims that since he first discovered the unprotected database, it received another 1.5 million entries, so it was a live/production system. The date when the database went online is unknown at this point, but it was finally secured on January 24, 2020. The next question is what kind of data has been leaked. Unfortunately, the answer to this is a pretty long one and includes the following:







Focusing on the credit card data, which is among the most severe exposures, the researcher clarifies that the entries contain the first and last four digits of the card numbers. While malicious actors couldn’t proceed to full exploitation, the data would still be enough to set up scams and various frauds. Especially when combined with the other information that was exposed, there’s really nothing else a scammer could have asked for.

Cineplanet maintains 40 theaters in Peru, so we’re talking about a large entity that should have followed better practices. Besides the failure to secure the database, the organization demonstrated that they are unreliable by storing user passwords without any encryption. The best way for people to respond to this incident would be to boycott Cineplanet and avoid providing such sensitive data to untrustworthy parties in general. Whatever offers, discounts, gifts, and rewards that you may have received from the cinema chain, they are not enough to make up for the damage done by this security incident.

For a better user experience we recommend using a more modern browser. We support the latest version of the following browsers: For a better user experience we recommend using the latest version of the following browsers: