InfoSecBulletin Cybersecurity for mankind
SL Data Services/Propertyrec, an information research provider exposes a non-password-protected database containing more than 600K records according to the security researcher Jeremiah Fowler. The dataset contains over 713 GB records including vehicle records, property ownership reports and court records.
Jeremiah Fowler said, around 95% of the limited sample of documents were The “background checks” included full names, addresses, phone numbers, email addresses, employment details, family members, social media accounts, and criminal records. I discovered that some individuals with unique names shared the same name and home address found in these checks.
CVSS 9.6: IBM QRadar & Cloud Pak Security Flaws Exposed
ALERT
Thousands of IP addresses compromised nationwide: CIRT warn
New Android Malware ‘Crocodilus’ Targets Banks in 8 Countries
Qualcomm Patches 3 Zero-Days Used in Targeted Android Attacks
Critical RCE Flaw Patched in Roundcube Webmail
Hacker claim Leak of Deloitte Source Code & GitHub Credentials
CISA Issued Guidance for SIEM and SOAR Implementation
Linux flaws enable password hash theft via core dumps in Ubuntu, RHEL, Fedora
Australia enacts mandatory ransomware payment reporting
Why Govt Demands Foreign CCTV Firms to Submit Source Code?
According to the researcher, the exposed dataset suggest the company operates a network of 16 different websites. For example, Propertyrec — a website that lists property and real estate data — was mentioned in the database’s name. After a responsible disclosure, The company restricted the public access over one week later, said Jeremiah Fowler.
Court records and sex offender statuses are typically public in the US, but this data could be merged with other information to create detailed profiles of individuals and their families, aiding criminals in targeted phishing and social engineering attacks. Another concern is impersonation, where a criminal uses the identity of someone whose personal information was leaked in a background check.
Using personally identifiable information (PII), like customer names and locations, in filenames for internal document storage can make file organization easier, but it’s not secure. If a data breach occurs, these filenames can lead to privacy risks, even more so if the files aren’t encrypted. Unauthorized users might access PII just by viewing the directory or file metadata without needing to open the file.
This discovery follows the August 2024 data breach of National Public Data, which exposed the personal information of millions. Hackers accessed the company’s systems and put the stolen data, including names, addresses, and phone numbers, for sale on the dark web for $3.5 million USD. The dataset included personal information of citizens from the US, Canada, and the UK.
The register reported, ” The info service provider eventually closed up the S3 bucket, says Fowler, although he never received any response. The Register also reached out to SL Data Services for comment and did not hear back.”
