InfoSecBulletin Cybersecurity for mankind
SL Data Services/Propertyrec, an information research provider exposes a non-password-protected database containing more than 600K records according to the security researcher Jeremiah Fowler. The dataset contains over 713 GB records including vehicle records, property ownership reports and court records.
Jeremiah Fowler said, around 95% of the limited sample of documents were The “background checks” included full names, addresses, phone numbers, email addresses, employment details, family members, social media accounts, and criminal records. I discovered that some individuals with unique names shared the same name and home address found in these checks.
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
According to the researcher, the exposed dataset suggest the company operates a network of 16 different websites. For example, Propertyrec — a website that lists property and real estate data — was mentioned in the database’s name. After a responsible disclosure, The company restricted the public access over one week later, said Jeremiah Fowler.
Court records and sex offender statuses are typically public in the US, but this data could be merged with other information to create detailed profiles of individuals and their families, aiding criminals in targeted phishing and social engineering attacks. Another concern is impersonation, where a criminal uses the identity of someone whose personal information was leaked in a background check.
Using personally identifiable information (PII), like customer names and locations, in filenames for internal document storage can make file organization easier, but it’s not secure. If a data breach occurs, these filenames can lead to privacy risks, even more so if the files aren’t encrypted. Unauthorized users might access PII just by viewing the directory or file metadata without needing to open the file.
This discovery follows the August 2024 data breach of National Public Data, which exposed the personal information of millions. Hackers accessed the company’s systems and put the stolen data, including names, addresses, and phone numbers, for sale on the dark web for $3.5 million USD. The dataset included personal information of citizens from the US, Canada, and the UK.
The register reported, ” The info service provider eventually closed up the S3 bucket, says Fowler, although he never received any response. The Register also reached out to SL Data Services for comment and did not hear back.”
