A Canadian mortgage broker’s database containing personal information on thousands of people was left open on the internet, according to security researchers.
Access to the database belonging to Toronto-based 8Twelve Financial Technologies was quickly restricted after the company was notified by researcher Jeremy Folwer and the staff of Website Planet, which offers resources for website builders.
According to a report issued today, the database has 717,814 records on thousands of Canadian residents, with home mortgage loan-related information including names, phone numbers, email addresses, physical addresses, and more. Many of the records appeared to be mortgage leads of people who want to buy a house, refinance, obtain an equity line of credit, or purchase an investment property, the report says.
“We immediately sent a responsible disclosure notice and 8Twelve acted fast and professionally by restricting public access within hours of our discovery,” the researchers say.
ITWorldCanada emailed 8Twelve Financial chief marketing officer Rick McLaughlin asking for an interview with an official to explain how the incident happened. No response had been received by press time.
The company has two lines of business: 8Twelve Mortgage for mortgage lending, which, the company’s site says, negotiates with 65 lenders to find the best mortgage rates in the North York region of Toronto; and 8T Capital, which offers short-term loans.
This apparent breach of security controls is just the latest in a string of corporate databases found unprotected on the internet. Often these wrongly-configured files are uploaded to cloud storage sites like Amazon AWS, where the creators put them temporarily or intend to do data analysis, and then forget to either password-protect the files or to ensure they aren’t connected to the public internet.
A blog by vendor SecurityTrails notes that some of the most common database blunders involve the use of Elasticsearch, a database for storing and analyzing large amounts of data. Elasticsearch by default binds to localhost only, the article notes, which is secure enough. But, it adds, to make Elasticsearch usable in an organization, database administrators often make the mistake of binding Elasticsearch to the public network interface without firewalling it.
A great tool for finding exposed databases is the Shodan search engine, which finds anything connected to the internet. As a 2017 article on exposed databases in Wired noted, if you want to find all the MongoDB databases connected to the public internet, just type “MongoDB” into Shodan. Not all of the databases found will have sensitive personal information, but some might.
According to Website Planet, the database contained:
- 717,814 records. The database contained one folder named “applicant” and five folders named “application”;
- applicant names, emails, phone number for work, home, and cell. Some records contained physical addresses, state or province. As most of the data could relate to a specific individual, data found in the records could be considered Personally Identifiable Information (PII);
- in a random sampling of 10,000 records, the term “email” returned 18,382 results. Each record displayed contained two email addresses; one belonging to the applicant accompanied by a corresponding one from the 8Twelve agent who was assigned the lead. Nearly all common email services appeared in the data, notably Gmail (13,695 results), and Yahoo (3,406), along with Outlook, iCloud, AOL, and smaller numbers of multiple other email providers.
- mortgage leads from multiple Canadian provinces were collected in multiple folders marked as “Prod” (which we assume stands for “production”). The records appeared to indicate where the leads came from: Facebook ads, referral, website, etc. Campaign ID numbers were also listed in the applicant files, which we may infer were for the purposes of internal tracking of sales and marketing effectiveness.
- applicants’ self-submitted information about their own financial standing, in the form of their credit scores, bankruptcy, savings, finances, and other data to start the loan application process. For credit evaluation purposes, mortgage agents may need to determine an applicant’s creditworthiness by disclosing the aforementioned financial information to an independent credit reporting agency or another source.
- records also included 8 Twelve employee names, email addresses, and internal notes about the prospective loan or customer, indicating whether an applicant was credit-worthy or not.
It’s unknown how long the unprotected database was open to the internet.
The post Customer database of Canadian mortgage broker left open on internet first appeared on IT World Canada.
