InfoSecBulletin Cybersecurity for mankind
Jeremiah Fowler, a cybersecurity researcher, found an unprotected server revealing 378 GB of Navy Federal Credit Union files, including operational Tableau data, but no customer details.
The misconfigured server has been found with sensitive internal files from Navy Federal Credit Union (NFCU), the largest credit union for military members.
Microsft warns of active directory and office vulnarabilty
(CVE-2025-10159)
Sophos Addressed Critical Auth Bypass flaw in Wireless Access Points
1.6M fitness phone call recordings exposed online
Microsoft September Patch Tuesday 2025 fixes 81 flaws, two zero-days
Elastic Security Incident : Hackers Accessed Email Account Contains Valid Credentials
Hacker Exploit Amazon SES to Send 50K Phishing Emails
SafePay Ransomware
SafePay Ransomware Attacks 73 Orgs in a Single Month
Bangladesh Cyber Threat Landscape- 2024
602 Vuln exploited: Afftected daily 905 IP In Bangladesh in 2024
AI-powered malware hit 2,180 GitHub accounts in “s1ngularity” attack
ISC2 Aims to Bridge DFIR Skill Gap with New Certificate
He discovered unencrypted backup data in an open database that anyone could access without a password.
The 378 GB database didn’t have any plain text credit union member data, but it did expose internal usernames, email addresses, and possibly hashed passwords and keys.
Fowler’s screenshots verified user roles in the credit union. He also discovered many Tableau workbooks in the database, which are files used for data analysis. These files included important details like connections to other internal databases and formulas for calculating financial metrics like loan performance and profits.
This information, while not customer data, could act as a “blueprint” for how the credit union’s internal systems operate. Furthermore, the backup files included important system information, such as logs, product codes, and data that should have remained private.
Although customer data wasn’t directly exposed, the security issue poses a significant risk. Fowler notes that this leaked information can guide criminals in future attacks. Hackers might use the leaked internal emails and names to craft convincing phishing attempts, allowing them to gain deeper network access.
“These files can sometimes be just a representation of the production data, but they still may reveal underlying structures or metadata that indicate how the backup software associates or connects these files to production systems,” Fowler noted in his report.
Fowler quickly informed NFCU, and they secured the database within hours. However, it’s unclear how long it was exposed or if anyone else accessed the data.
This incident highlights that organizations should secure backup data just like live data. It also emphasizes the importance of encrypting backup files and regularly reviewing security protocols, including those of third-party contractors.
NVIDIA Releases Security Updates for BlueField, DOCA, Mellanox, ConnectX and NVOS
