24 Million Mortgage, Loan Documents Exposed Through an Unprotected Server

Image: Shutterstock.

A 24 million financial and banking documents bounty, representative of thousands of loans and mortgages from some major U.S., financial institutions were discovered online, unprotected, after a server security lapse.

TechCrunch reported the server, operating an Elasticsearch database, had more than 10 years of accumulated data including loan and mortgage contracts, reimbursement schedules, tax documents and other sensitive personal financial info. “It’s believed that the database was only exposed for two weeks — but long enough for independent security researcher Bob Diachenko to find the data (on January 10). At first glance, it wasn’t immediately known who owned the data. After we inquired with several banks whose customers information was found on the server, the database was shut down on January 15.” Diachenko discovered the data freely accessible via the internet and not even protected by a password.