Skip to main content

This widely-used instant loan app leaks nearly 30 million files of user data

Web Hosting & Remote IT Support
  • FatakPay, an Indian loan company, was found storing sensitive data in an unprotected S3 bucket
  • The data included people's names, addresses, IDs, and more
  • The company has since locked the database down

Instant loan company FatakPay kept sensitive data on millions of its users exposed on the internet, for an unknown period of time to anyone who knew where to look.

In mid-September 2024, security researchers from Cybernews discovered a misconfigured Amazon AWS S3 bucket containing more than 27 million files filled with sensitive information.

The data found in the bucket includes people’s full names, postal addresses, email addresses, phone numbers, copies of national IDs, loan agreements, account statements, filled-in loan applications, user selfies for verification, PAN (a PIN number issued by the Indian Income Tax Department), Aadhar (a PIN number issued by the Unique Identification Authority of India), and credit score reports.

Closing the archive

After a few attempts, the researchers managed to get in touch with FatakPay, which then closed the bucket, but has not yet released an official statement regarding the discovery.

FatakPay is a digital payment and micro-lending platform in India that provides instant credit solutions to users for small-ticket transactions. At press time, its Google Play Store page shows 1M+ downloads, but the exact number of active users is not publicly available.

Misconfigured databases remain one of the key causes of data leaks. Some researchers warned that many organizations don’t fully understand the shared responsibility model of most cloud hosting providers, and that they believe it is the service provider’s job to keep the data secure.

As a result, researchers often stumble upon large databases full of information that crooks could use for identity theft, phishing, social engineering, wire fraud, and more.

Recently, a Mexican fintech startup was found holding a large database full of sensitive customer data wide open on the internet. The company, called Kapital, held data on 1.6 million Mexicans, including voter IDs and selfies.

You might also like



via Hosting & Support
Labels:

Comments

Post a Comment

Web Hosting
Remote IT Support
Sites & Socials

Popular posts from this blog

AI tools are making social engineering attacks even more convincing, and I fear that this is only the beginning

Web Hosting & Remote IT Support Nick Park’s Wallace and Gromit were brought crashing into the 21st century in December 2024 with their latest adventure, Vengeance Most Fowl . The film challenges our growing dependence on smart technology in the form of a robotic garden gnome, built by Wallace to support his gardening business, which is then hacked by the Kubrick-esque Feathers McGraw for his own nefarious purposes. One of the more interesting but less commented on parts of the film shows Gromit cautiously entering his house and being greeted by what he thinks is Wallace’s reassuring voice, only to be confronted with Feathers and the robotic gnome. Technology’s ability to mimic linguistic patterns, to clone a person’s voice and understand and respond to questions has developed dramatically in the last few years. This has not gone unnoticed by the world’s criminals and scammers, with the result that social engineering attacks are not only on the rise but are more sophisticated a...
Post a Comment
Read more

Want a remote control for your smart home? SwitchBot has made a Matter-compatible one

Web Hosting & Remote IT Support SwitchBot has launched a unique piece of tech capable of controlling smart home devices and infrared appliances. And the best part is you don’t need to connect it to a smartphone or to the internet as it functions perfectly offline.  Aptly named the SwitchBot Universal Remote , it has large spacious buttons, a navigation wheel in the middle, and a 2.4-inch LCD at the top. The company states in their announcement it sought to create a “user-friendly design” that everybody can understand. Now, you can’t just point the Universal Remote at a device and then push a button to issue commands immediately. According to Android Central , you must first choose what you want to control, which can be done by pressing the center red button. Pressing the main button will let you change which group of smart home devices to control.  Universal Remote has launched! 🚀 Consolidate all your remotes, and control everything at home, even #automation! NOW,...
Post a Comment
Read more