A web design flaw in First American Financial Corporation's document transfer system left around 885 million files exposed on the web with no security, reports independent reporter Brian Krebs.
Why it matters: Krebs notes that the documents, which date back to 2003, include "bank account numbers and statements, mortgage and tax records, Social Security numbers, wire transaction receipts, and drivers license images."
Details: The flaw, which has been repaired, appears to have been in an online system the firm used to link to files in private communications. Users would be sent to a website whose web address included a file number.
- However, the files themselves were not individually protected. By changing the file number, you could access any one of the documents.
- Krebs was alerted to the data exposure by developer Ben Shoval.
Threat level: There's no public evidence at this point that anyone maliciously accessed the files. Though an exposure like this can be a predicate for a disaster — scammers, identity thieves and other criminals could do massive damage with these files in hand — we don't know whether such a disaster has happened, only that it could have.
