InfoSecBulletin Cybersecurity for mankind
Cybersecurity researcher Jeremiah Fowler found an unsecured database with 245,949 records, reported to vpnMentor. It likely belonged to a tax credit consulting agency and contained personal information such as PII, driver’s licenses, military discharge forms, Social Security numbers, and other sensitive documents.
The database was unprotected and held 245,949 records totaling 286.9 GB. I noticed that it included sensitive personal information in plain text, such as names, addresses, email addresses, dates of birth, and Social Security numbers. Additionally, it contained driver’s licenses, ID cards, Social Security cards, tax credit documents with job and salary details, and eligibility determination letters.
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
The database had DD214 forms, which are similar to certificates confirming a veteran’s military service. Along with these public records, it also included many password-protected PDF files labeled as “forms.” The filenames included personal information like the employer’s name, the applicant’s full name, a numeric code, and document number.
Jeremiah Fowler revealed that internal files suggested the records were linked to Rockerbox, a Texas company. Rockerbox specializes in tax credit consulting, helping businesses boost cash flow by managing employer-focused tax incentives such as the Work Opportunity Tax Credit (WOTC), Employee Retention Tax Credit (ERTC), R&D credits, and Empowerment Zone credits. The company is located in Dallas and serves clients nationwide.
Fowler said, after sending a responsible disclosure notice to Rockerbox the database was restricted from public access several days later and no longer accessible.
Rockerbox serves various industries, including restaurants, hospitality, healthcare, temporary staffing, trucking, manufacturing, warehouses, food processing, skilled trades, and golf courses.
In a 2024 report by Experian, the FTC recorded over 1.1 million identity theft claims and managed around 2.6 million fraud cases, resulting in losses over $12.7 billion. I want to clarify that I am not suggesting Rockerbox’s clients or their employees are at risk of fraud or have had their data compromised. I’m only discussing potential risks associated with exposed personal data.
Android malware Anatsa infiltrates Google Play targeting banks worldwide
