vpnMentor experts uncovered a database exposed online on Amazon Web Services (AWS) that is leaking a huge amount of sensitive legal and financial documents.
“Whatever the intended purpose of this database was, over 500,000 highly sensitive and private legal and financial documents were exposed, compromising numerous parties to the risk of fraud and theft.” reads the post published by vpnMentor.
The database appears to belong to MCA Wizard, an iOS and Android app developed by two companies: Advantage Capital Funding and Argus Capital Funding. The application was launched in January 2018, but it is currently no longer available for download.
Advantage and Argus seem to be the same company working under two different names, they offer funding and startup capital to business owners without access to traditional lending and financial services.
The researchers discovered the unsecured database in December 2019.
After the initial analysis, the experts were able to link the database to the two companies that unfortunately did not respond to any contact.
Then the researchers contacted AWS directly that secured the S3 bucket. Below the timeline of the discovery:
At the time of the discovery, the database contained over 500,000 documents for a total of 425GB of data. The documents were covering many aspects of Advantage and Argus’s businesses, finances, and dealings with other companies, they included:
“This leak raises serious credibility and trust issues for Advantage and Argus. By not sufficiently securing this database and revealing so much information, they have compromised the safety, privacy, and security of their clients, partners, and customers.” concludes vpnMentor.
“Furthermore, a leak like this may attract the attention of US financial and data security regulators.”
[adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – financial documents, cybercrime)
[adrotate banner=”5″]
[adrotate banner=”13″]
Over 1,400 CrushFTP internet-facing servers are vulnerable to attacks exploiting recently disclosed CVE-2024-4040 vulnerability. Over…
A ransomware attack on a Swedish logistics company Skanlog severely impacted the country's liquor supply. …
CISA adds Cisco ASA and FTD and CrushFTP VFS vulnerabilities to its Known Exploited Vulnerabilities…
U.S. CISA added the Windows Print Spooler flaw CVE-2022-38028 to its Known Exploited Vulnerabilities catalog.…
The U.S. Department of Justice (DoJ) announced the arrest of two co-founders of a cryptocurrency mixer…
Google addressed a critical Chrome vulnerability, tracked as CVE-2024-4058, that resides in the ANGLE graphics…
This website uses cookies.