InfoSecBulletin Cybersecurity for mankind
Jeremiah Fowler, a cybersecurity researcher, found an unprotected server revealing 378 GB of Navy Federal Credit Union files, including operational Tableau data, but no customer details.
The misconfigured server has been found with sensitive internal files from Navy Federal Credit Union (NFCU), the largest credit union for military members.
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
CIRT identified 153 publicly exposed FortiGate devices in Bangladesh
He discovered unencrypted backup data in an open database that anyone could access without a password.
The 378 GB database didn’t have any plain text credit union member data, but it did expose internal usernames, email addresses, and possibly hashed passwords and keys.
Fowler’s screenshots verified user roles in the credit union. He also discovered many Tableau workbooks in the database, which are files used for data analysis. These files included important details like connections to other internal databases and formulas for calculating financial metrics like loan performance and profits.
This information, while not customer data, could act as a “blueprint” for how the credit union’s internal systems operate. Furthermore, the backup files included important system information, such as logs, product codes, and data that should have remained private.
Although customer data wasn’t directly exposed, the security issue poses a significant risk. Fowler notes that this leaked information can guide criminals in future attacks. Hackers might use the leaked internal emails and names to craft convincing phishing attempts, allowing them to gain deeper network access.
“These files can sometimes be just a representation of the production data, but they still may reveal underlying structures or metadata that indicate how the backup software associates or connects these files to production systems,” Fowler noted in his report.
Fowler quickly informed NFCU, and they secured the database within hours. However, it’s unclear how long it was exposed or if anyone else accessed the data.
This incident highlights that organizations should secure backup data just like live data. It also emphasizes the importance of encrypting backup files and regularly reviewing security protocols, including those of third-party contractors.
NVIDIA Releases Security Updates for BlueField, DOCA, Mellanox, ConnectX and NVOS
