InfoSecBulletin Cybersecurity for mankind
SL Data Services/Propertyrec, an information research provider exposes a non-password-protected database containing more than 600K records according to the security researcher Jeremiah Fowler. The dataset contains over 713 GB records including vehicle records, property ownership reports and court records.
Jeremiah Fowler said, around 95% of the limited sample of documents were The “background checks” included full names, addresses, phone numbers, email addresses, employment details, family members, social media accounts, and criminal records. I discovered that some individuals with unique names shared the same name and home address found in these checks.
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
According to the researcher, the exposed dataset suggest the company operates a network of 16 different websites. For example, Propertyrec — a website that lists property and real estate data — was mentioned in the database’s name. After a responsible disclosure, The company restricted the public access over one week later, said Jeremiah Fowler.
Court records and sex offender statuses are typically public in the US, but this data could be merged with other information to create detailed profiles of individuals and their families, aiding criminals in targeted phishing and social engineering attacks. Another concern is impersonation, where a criminal uses the identity of someone whose personal information was leaked in a background check.
Using personally identifiable information (PII), like customer names and locations, in filenames for internal document storage can make file organization easier, but it’s not secure. If a data breach occurs, these filenames can lead to privacy risks, even more so if the files aren’t encrypted. Unauthorized users might access PII just by viewing the directory or file metadata without needing to open the file.
This discovery follows the August 2024 data breach of National Public Data, which exposed the personal information of millions. Hackers accessed the company’s systems and put the stolen data, including names, addresses, and phone numbers, for sale on the dark web for $3.5 million USD. The dataset included personal information of citizens from the US, Canada, and the UK.
The register reported, ” The info service provider eventually closed up the S3 bucket, says Fowler, although he never received any response. The Register also reached out to SL Data Services for comment and did not hear back.”
