Security News US Credit Union Service Leaks Millions of Records and Passwords in Plain Text

[vtqhtr413]

Content source

https://www.hackread.com/us-credit-union-service-plain-text-passwords-data-leak/

Cybersecurity researcher Jeremiah Fowler made a significant discovery: a 13 GB misconfigured cloud database resembling a Customer Relationship Management (CRM) system, reportedly linked to CU Solutions Group, a Michigan-based credit union service provider.

The data leak’s severity was made worse by two critical factors: firstly, it was left publicly accessible without any security authentication or password protection. Secondly, the server contained over 3 million records (3,125,660 in total), including a collection of sensitive information. This included over 1 million email conversations, internal notes, clients’ full names, physical addresses, details about thousands of credit unions across the United States, email addresses, and plaintext passwords.

In his blog post for Website Planet, Fowler detailed how he contacted CU Solutions Group for responsible disclosure, leading to the company securing the server on the same day. However, representatives of the company attributed the misconfiguration to a possible mismanagement by a third-party vendor, leaving the actual responsibility unclear.

Nevertheless, despite the database being secured, uncertainty remains regarding whether malicious threat actors, aside from Fowler (the good guy), had accessed it before the researcher’s report. If they had, it could lead to the breach being circulated on cybercrime forums. This, in turn, could result in additional cybersecurity threats, including ransomware attacks, spam, identity theft, account takeover due to plaintext passwords, phishing attacks, and more.

US Credit Union Service Leaks Millions of Records and Passwords in Plain Text

Follow us on Twitter (X) @Hackread - Facebook @ /Hackread

www.hackread.com

 

[Freki123]

Sorry but how can you store passwords in plaintext?
I mean they already fxxx up with no security authentication or password protection but shouldn't you at least store passwords as hash and salted (or whatever the standard is for it today)?