Yet another unsecured ElasticSearch database exposes over 24 million loan documents online

• The database had more than a decade’s worth of data that included loan and mortgage agreements, repayment schedules and other financial and tax documents.
• The unprotected database was exposed online for at least a period of two weeks before it was shut down on January 15.

A trove of more than 24 million bank loan and mortgage documents from some of the biggest banks in the US, has been leaked online following a server security lapse. The server was running an ElasticSearch database that was not protected with a password.

What all was stored in the database?

The database had more than a decade’s worth of data that included loan and mortgage agreements, repayment schedules and other financial and tax documents.

The unprotected database was exposed online for at least a period of two weeks before it was shut down on January 15. It included documents dating back to at least 2008 and included documents from Citigroup, Wells Fargo, Capital One, and the Department of Housing and Urban Development among others.

“It’s believed that the database was only exposed for two weeks — but long enough for independent security researcher Bob Diachenko to find the data. At first glance, it wasn’t immediately known who owned the data. After we inquired with several banks whose customers information was found on the server, the database was shut down on January 15,” TechCrunch reported.

The documents also contained highly sensitive personal information such as people’s names, addresses, addresses, dates of birth and Social Security numbers.

According to TechCrunch, the leak was traced back to Ascension, a Texas-based company that provides data and analytics to the financial services industry.

Sandy Campbell, General Counsel at Ascension’s parent company Rocktop Partners, confirmed the breach. The firm is working with third-party forensic experts to resolve the matter. It has also informed the law enforcement agencies about the breach.