NCF Leaves Sensitive Private Customer Data Exposed Online

Among several major cases of data leaks, the most recent one appears to be that by the National Credit Federation (NCF), which reportedly left the sensitive, private data of customers—including credit card numbers; credit reports from three major reporting agencies Equifax, Experian, and TransUnion; bank account numbers; and Social Security numbers—exposed online.

NCF is a nationwide, membership-based organization which aims to help people who are currently in or have successfully come through a financial crisis and take back control of their finances and credit.

In this regard, Chris Vickery, Director of Cyber Risk Research at UpGuard (a cyber-resilience startup company that determines a company’s cyber-risk factors by scanning both internal and external computer systems), stated that NCF left 111GB of internal customer information on an Amazon Web Services S3 cloud storage bucket configured to allow public access without restriction. Notably, Vickery, who discovered the bucket, said that the discovery was made on October 3, 2017.

Information on the server potentially impacted tens of thousands of customers. Notably, the information included customer names, addresses, birth dates, driver’s licenses and Social Security card scans, credit blueprints containing detailed financial histories, and full credit card and bank account numbers.