- Security researcher finds large unsecured online database belonging to Willow Pays
- The database contained lots of sensitive customer information
- It is now locked, but users should still be careful
Bill payment platform Willow Pays kept a huge database full of sensitive customer information unprotected online available to anyone who knew where to look, an expert has claimed.
Researcher Jeremiah Fowler, known for hunting misconfigured and non-password-protected databases on the Internet, revealed that he recently discovered a database with more than 240,000 records.
“There were folders inside the database indicating bills, mailing lists, account discrepancies, repayment plans, screenshots, settings and snapshots,” he said. “In a limited sample of the leaked documents, I saw records that included names, email addresses, credit limits and other internal information. A single spreadsheet document contained the information of 56,864 people, indicating whether they were prospects, active customers or blocked accounts. “
Missing details
Soon after, Fowler was able to attribute the database to Willow Pays, a financial service that helps users manage their bills by paying them in advance. The service allows users to repay the amount in four interest-free installments, making it easier to manage expenses. This service also supports building credit by ensuring timely repayment.
Fowler reached out to Willow Pays, who shut down the database soon after. However, the company did not respond to his emails and did not say whether it manages the database in-house or if the job was outsourced to a third party. Furthermore, we don’t know how long the database remained unlocked or whether any malicious actors accessed it before Fowler did.
Misconfigured databases remain one of the most common causes of data leaks and waste on the Internet. Many security researchers warn that companies don’t understand the common security model of most cloud service providers these days and are mistakenly relying too much on them instead of protecting their assets themselves.
Via Homepage Planet
