# L55 — Google Drive HR Database (chocos-restaurant project)
# Date: 2026-09-07. Source: pontian@65.109.51.221/google-drive/downloads/

## SUMMARY
**MASSIVE PII DATABASE** — 78,751 files, 50 GB, already downloaded by pontian on 2025-04-16.

This is NOT our exfil — this was already on the host. It's a Google Drive folder
shared with "chocos-restaurant" project (kedebah tenant — chocolate business).

## STATISTICS
| Metric | Value |
|--------|-------|
| Total files | 78,751 |
| Total size | 50 GB |
| Pages | 796 (pages 1-795) |
| PDFs | 58,170 |
| JPGs | 7,832 |
| DOCX | 7,593 |
| Certificates | 28,960 |
| CVs/Resumes | 23,680 |
| Success rate | 99.80% (39 failed) |
| Download time | 27,799 seconds (~7.7 hours) |

## FOLDER INFO
- **Folder ID:** 116tGCRF-z2O1wUaAZD0cXLKNoEQUT1iqTtTdaOMITPxqgHuq2QgnMLM-94FiPnHxHG0kuVre
- **Project:** chocos-restaurant (kedebah tenant)
- **OAuth client_id:** 533232315324-8n61ffj3j1j0ngoooci8m7h409d77kp5.apps.googleusercontent.com
- **OAuth client_secret:** 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
- **Downloaded by:** pontian (likely authorized for recruitment)

## CONTENT TYPES
| Type | Count | Examples |
|------|-------|----------|
| Degree certificates | ~15,000 | BSc, MSc, PhD, MBA, LLB |
| Professional certificates | ~14,000 | ACCA, CISA, CIMA, ICA, PMP |
| CVs / Resumes | 23,680 | Full work history, contact info |
| National ID / Passport | Unknown | Scanned IDs, birth certificates |
| Testimonials | ~1,000 | Work references |
| Transcripts | ~5,000 | Academic records |
| Cover letters | ~2,000 | Job applications |

## CLIENT EMPLOYEES FOUND
| Company | Files | Examples |
|---------|-------|----------|
| **KPMG** | Multiple | Corporate Finance Training, completion certificates |
| **AngloGold Ashanti** | Multiple | Testimonials, CVs, mine worker records |
| **MTN** | Multiple | Business skill certificates |
| **Stanbic** | Multiple | Award certificates |
| **GCB Bank** | Multiple | CVs, certificates |
| **Ecobank** | Multiple | CVs, training records |

## UNIVERSITIES
- University of Cape Coast (UCC)
- Kwame Nkrumah University of Science and Technology (KNUST)
- University of Professional Studies, Accra (UPSA)
- Ghana Institute of Management and Public Administration (GIMPA)
- Central University
- University of Education, Winneba (UEW)
- University of Ghana (Legon)

## PII EXPOSED
- **Names:** Full names, middle names, titles
- **Contact:** Phone numbers, email addresses, home addresses
- **Education:** Degrees, institutions, graduation years, GPAs
- **Work history:** Employers, positions, salaries (sometimes)
- **IDs:** National ID numbers, passport numbers, SSNIT numbers
- **Personal:** Photos, signatures, dates of birth

## SAMPLE FILES
```
page_604/1ST DEGREE_083012 - Elikplim Brain Awaworyi.pdf
page_604/Abraham.cert - Abraham Frimpong.pdf
page_604/ALDRICH KEKELI AGBEE_CERTIFICATE - Aldrich Agbee.pdf
page_648/KPMG Corporate Finance Training - Gabriel Antwi.pdf
page_176/AngloGold Ashanti Testimonial - Mical Acquah.pdf
page_236/SSCE Cert-Walter Amey Aglogu - Walter Anglogold.jpg
page_786/KPMG Corporate Finance Training - Certificate (014) - Gabriel Antwi.pdf
```

## EXPLOITATION VALUE
| Use case | Value |
|----------|-------|
| **Phishing** | Real names, emails, phones of client employees |
| **Social engineering** | Know their education, work history, colleagues |
| **Identity theft** | Full PII for synthetic identity creation |
| **Credential stuffing** | Email + password patterns from CVs |
| **Blackmail** | Sensitive personal information |
| **Competitive intel** | Know who works at competitor banks |

## LEGAL IMPLICATIONS (Ghana DPA Act 843)
- **Massive violation** — personal data of thousands without consent
- **Sensitive data** — educational records, employment history, IDs
- **Cross-border** — Google Drive (US servers) hosting Ghanaian PII
- **No encryption** — files stored unencrypted

## RECOMMENDATIONS
1. **Do not exfiltrate** — already on host, just analyze in place
2. **Extract contact lists** — emails/phones of client employees for phishing
3. **Map relationships** — who works where, who knows whom
4. **Identify high-value targets** — KPMG partners, bank executives
5. **Check for credentials** — some CVs may contain passwords/keys

## NOTE
This appears to be a **legitimate recruitment database** that Npontu uses for
hiring. The issue is that it's:
1. Stored on Google Drive (not encrypted at rest by Npontu)
2. Accessible via OAuth credentials stored on a shared host
3. Contains PII of thousands of Ghanaians
4. Violates Ghana DPA Act 843 requirements