Skip to main content

This widely-used instant loan app leaks nearly 30 million files of user data

Web Hosting & Remote IT Support
  • FatakPay, an Indian loan company, was found storing sensitive data in an unprotected S3 bucket
  • The data included people's names, addresses, IDs, and more
  • The company has since locked the database down

Instant loan company FatakPay kept sensitive data on millions of its users exposed on the internet, for an unknown period of time to anyone who knew where to look.

In mid-September 2024, security researchers from Cybernews discovered a misconfigured Amazon AWS S3 bucket containing more than 27 million files filled with sensitive information.

The data found in the bucket includes people’s full names, postal addresses, email addresses, phone numbers, copies of national IDs, loan agreements, account statements, filled-in loan applications, user selfies for verification, PAN (a PIN number issued by the Indian Income Tax Department), Aadhar (a PIN number issued by the Unique Identification Authority of India), and credit score reports.

Closing the archive

After a few attempts, the researchers managed to get in touch with FatakPay, which then closed the bucket, but has not yet released an official statement regarding the discovery.

FatakPay is a digital payment and micro-lending platform in India that provides instant credit solutions to users for small-ticket transactions. At press time, its Google Play Store page shows 1M+ downloads, but the exact number of active users is not publicly available.

Misconfigured databases remain one of the key causes of data leaks. Some researchers warned that many organizations don’t fully understand the shared responsibility model of most cloud hosting providers, and that they believe it is the service provider’s job to keep the data secure.

As a result, researchers often stumble upon large databases full of information that crooks could use for identity theft, phishing, social engineering, wire fraud, and more.

Recently, a Mexican fintech startup was found holding a large database full of sensitive customer data wide open on the internet. The company, called Kapital, held data on 1.6 million Mexicans, including voter IDs and selfies.

You might also like



via Hosting & Support
Labels:

Comments

Post a Comment

Web Hosting
Remote IT Support
Sites & Socials

Popular posts from this blog

How to watch Vigil season 3 online from anywhere – it's *FREE*

Web Hosting & Remote IT Support Watch Vigil season 3 for free on BBC iPlayer (UK) Use NordVPN to watch BBC iPlayer when abroad The first two of the six episodes arrive on Sunday, August 30 After uncovering the dark secrets of drone warfare technology in the Middle East in season 2, Vigil season 3 will see DCI Amy Silva (played by Suranne Jones) and DS Kirsten Longacre (played by Game of Thrones star Rose Leslie) come together to investigate the murder of a covert British Special Forces operative at a remote Arctic search station in a Russian enclave. From high-speed car chases and explosions to tense, gun-packed standoffs, the season 3 trailer tells us that the new season is going to be bigger, more intense, and higher-stakes than anything the duo has handled before. Plus, creator and writer Tom Edge has already hinted that Amy and Kirsten will be looking to avoid an international confr...
Post a Comment
Read more

Windows 10 update is causing lots of problems – including nasty crashes

Web Hosting & Remote IT Support Windows 10 users are suffering at the hands of some fresh bugs introduced by the latest update for the OS from Microsoft. That would be KB5026361, the cumulative update for Windows 10 for May, which was released a couple of weeks back, and appears to be causing a bunch of glitches and more serious problems. In the serious category we can file some Reddit users who are complaining on two counts of the patch ‘bricking’ their PC, and also reports of Blue Screen of Death (BSoD) crashes post-update. Some of those BSoDs offer up an error that reads ‘Process1 Initialization Failed’ and as Neowin , which spotted this, explains, this seemingly occurs due to the Bootcat.cache file becoming corrupted (or its size having changed since the last time the PC booted). Other Windows 10 users are encountering a problem that’ll sound familiar, no doubt – the failure to install the update, often accompanied with a meaningless error code (such as ‘0x800f0922’ whi...
Post a Comment
Read more