1,000,000+ Financial Records Exposed in Data Incident Involving Fintech Company
Syndicated By: Iain Fraser - Cybersecurity Journalist Gibraltar
Google Indexed on 130423 at 12:21 CET (Web & Hype Newsroom)
13 April 2023
Cybersecurity researcher Jeremiah Fowler discovered and reported to WebsitePlanet a non-password protected database that contained a large number of PDF documents.
The PDF documents that were made public included invoices from both individuals and businesses who used an app to pay for products and services. The invoices contained names, email addresses and physical addresses, phone numbers, and more. In addition, the documents also included notes about what the payment was for, the total amount, due date, and some even contained tax information such as a tax id number.
Upon further research, it was identified that the database belonged to NorthOne Bank, a financial technology company that is used by over 320,000 American businesses (based on information on their website). It is worth noting that NorthOne is not a full service bank. Banking services to NorthOne Bank are provided by The Bancorp Bank, which is also a member of the Federal Deposit Insurance Corporation (FDIC), a government agency that provides deposit insurance to financial institutions. NorthOne Bank has offices in New York, USA and Toronto, Canada and its services are available throughout North America.
I immediately sent a responsible disclosure notification to NorthOne Bank of the discovery of the possible security concern. Subsequently, I was informed by the bank that they had “investigated and had resolved the issue and that there were no outstanding open issues”. I first reported the finding on January 19th, 2023 and the database remained unsecured until January 31st, 2023, after sending several followup messages, restricting the access to the database and thus to the .PDF documents. It is unclear how long these records were exposed or who else may have had access to the database, if anyone did. We imply no claims or accusations about NorthOne Bank’s security practices. Details provided here are based on the response I received from the bank and our intention is solely to promote better security measures and responsible handling of potential vulnerabilities. It should also be noted that Bancorp Bank is not at fault or responsible for this breach.
The database allowed anyone with an internet connection and the database’s URL to see or download the .PDF documents. There were basic security controls preventing a full indexing of all documents. I estimated that there were over a million files in the database that were marked as “production”. In a random sampling of 1,000 invoices, I observed invoice amounts ranging from as low as $60 to over $10,000 for various services. These included home repairs, pet services, food and beverage, and even medical care. Learn More /...
About Jeremiah Fowler
Jeremiah Fowler is a Security Researcher and co-founder of Security Discovery. Jeremiah began his career in security research in 2015 and has a mission of data protection. He has helped identify and secure the data of millions of people around the world. His discoveries have been covered in Forbes, BBC, Gizmodo, among others. Security and responsible disclosure are not only a passion, but a way of protecting our digital lives. Learn More /...
