InfoSecBulletin Cybersecurity for mankind
Jeremiah Fowler, a cybersecurity researcher, found an unprotected server revealing 378 GB of Navy Federal Credit Union files, including operational Tableau data, but no customer details.
The misconfigured server has been found with sensitive internal files from Navy Federal Credit Union (NFCU), the largest credit union for military members.
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
He discovered unencrypted backup data in an open database that anyone could access without a password.
The 378 GB database didn’t have any plain text credit union member data, but it did expose internal usernames, email addresses, and possibly hashed passwords and keys.
Fowler’s screenshots verified user roles in the credit union. He also discovered many Tableau workbooks in the database, which are files used for data analysis. These files included important details like connections to other internal databases and formulas for calculating financial metrics like loan performance and profits.
This information, while not customer data, could act as a “blueprint” for how the credit union’s internal systems operate. Furthermore, the backup files included important system information, such as logs, product codes, and data that should have remained private.
Although customer data wasn’t directly exposed, the security issue poses a significant risk. Fowler notes that this leaked information can guide criminals in future attacks. Hackers might use the leaked internal emails and names to craft convincing phishing attempts, allowing them to gain deeper network access.
“These files can sometimes be just a representation of the production data, but they still may reveal underlying structures or metadata that indicate how the backup software associates or connects these files to production systems,” Fowler noted in his report.
Fowler quickly informed NFCU, and they secured the database within hours. However, it’s unclear how long it was exposed or if anyone else accessed the data.
This incident highlights that organizations should secure backup data just like live data. It also emphasizes the importance of encrypting backup files and regularly reviewing security protocols, including those of third-party contractors.
NVIDIA Releases Security Updates for BlueField, DOCA, Mellanox, ConnectX and NVOS
