We continue the marathon of leaks from Russian databases left by their owners in open access.
This time, a MongoDB database was discovered that doesn't require authentication, containing personal data and photographs of borrowers from the Southern, Ural, and Volga Federal Districts, along with all their loan applications.
Disclaimer: all information below is published solely for educational purposes. The author did not obtain access to personal data of third parties and companies. Screenshots were taken either from open sources or provided to the author by well-wishers.The database, approximately 158 GB in size, contained 74 collections, and according to the search engine BinaryEdge (about how open databases are discovered, Based on indirect signs, a hypothesis was made regarding the possible owner of the database: all (5042) users from the collection
had email addresses on the domains users @poslogic.pro and @ finservice.proand additionally, the database's IP address differed by only 1 from the IP address of the site www.finservice.pro Finservice has been operational since 2012 and is a leading independent financial broker in the area of POS lending in the Russian market. Currently, Finservice is part of a large diversified holding and employs over 200 staff, actively expanding into all regions of Russia..
On the website Finservice has been operational since 2012 and is a leading independent financial broker in the area of POS lending in the Russian market. Currently, Finservice is part of a large diversified holding and employs over 200 staff, actively expanding into all regions of Russia. it says:
We are the developer and rights holder of a leading POS lending platform in the market—Poslogic. The platform is integrated with all leading banks in this segment and allows for the optimization of processes related to consumer loan issuance, increasing the revenue of retail organizations, and satisfying any client requests.
I Googled what POS lending is (information from
www.banki.ru POS lending (POS – Point Of Sale) is a direction in retail banking business providing loans for specific goods directly at retail points. This business is considered highly profitable but also high-risk. Typically, such loans have high interest rates—over 30%—but at the same time, quick decisions (within an hour) are made.):
POS financing (POS — Point Of Sale) is a retail banking business model that involves issuing loans for specific goods directly at points of sale. This business is considered highly lucrative but also high-risk. Typically, such loans are characterized by high interest rates—over 30%—but at the same time, decisions are made quickly (within an hour).
The company did not respond to my emails, messages through Facebook Messenger, or public posts on Facebook. Email info@finservice.pro, listed on the website, does not work at all, and the social media presence is neglected. I had to search the site for employees' emails and write to them. Of course, no response followed…
However, on March 21 around 5 PM (Moscow time), the database disappeared from public access. I want to emphasize that during the observation, the database was constantly updated and supplemented with new records. For example, in one day there were more than 50 new loan applications.
The database contained:
- Over 294,000 borrowers: full name, place of birth, date of birth, number of children, number of dependents, mother's maiden name, marital status, education, mobile phone number, landline number, email address, registration address, actual residence address, full passport details.
All borrowers were from the Southern, Ural, and Volga federal districts (residential addresses).
- Over 183,000 loan data entries: loan amount, loan status, issue date, bank identifier, borrower identifier, payment schedule for the loan, etc.
Over 819,000 scanned documents: document type, file name, link to JPG file, status, date, etc.
{ "_id" : ObjectId("5c925eb52fc14e00019d1907"), "_type" : "QuestionaryDocumentScan", "doctype" : "pd_agreement", "title" : "Personal Data Processing Agreement", "filename" : "1.jpg", "status" : NumberInt(0), "status_text" : "Uploaded", "questionary_id" : ObjectId("5c925c8a4624cb000141cfb5"), "sent" : false, "required_resend" : false, "scan" : "5c925eb52fc14e00019d1907.jpg", "updated_at" : ISODate("2019-03-20T15:39:33.591+0000"), "created_at" : ISODate("2019-03-20T15:39:33.591+0000") }Over 246,000 photographs of people who applied for loans, taken with webcams at points of sale, in JPG format.
(faces blurred for the article)
- More than 5,000 internal system users: full name, date of birth, login and hashed password, mobile phone, email addresses on the domains and @ and @finservice.pro.
- Over 2,500 partners (presumably points of sale for goods for which loans were taken): name, bank details, actual address, legal address, contacts, etc.
- Over 1,000 credit products: name, bank identifier, commission size, etc.
- A very small (862) 'blacklist' of borrowers.
- and a lot of other information containing personal data.
News about data leaks and insiders can always be found on my Telegram channel "».
Source: habr.com
