{"id":30306,"date":"2019-10-31T21:34:48","date_gmt":"2019-10-31T18:34:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vse-vashi-potrebkredity-i-personalnye-dannye-v-odnom-meste\/"},"modified":"2019-10-31T21:34:48","modified_gmt":"2019-10-31T18:34:48","slug":"vse-vashi-potrebkredity-i-personalnye-dannye-v-odnom-meste","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/vse-vashi-potrebkredity-i-personalnye-dannye-v-odnom-meste","title":{"rendered":"All your consumer loans and personal data 'in one place'\u2026","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

We continue the marathon of leaks from Russian databases left by their owners in open access.<\/p>\n

<\/p>\n

\"All<\/p>\n

<\/p>\n

This time, a MongoDB database was discovered that doesn't require authentication, containing personal data and photographs of borrowers from the Southern, Ural, and Volga Federal Districts, along with all their loan applications.<\/p>\n

<\/a><\/noindex><\/p>\n

Disclaimer: all information below is published solely for educational purposes. The author did not obtain access to personal data of third parties and companies. Screenshots were taken either from open sources or provided to the author by well-wishers.<\/code><\/pre>\n
<\/p>\n
The database, approximately 158 GB in size, contained 74 collections, and according to the search engine BinaryEdge (about how open databases are discovered, I wrote a separate article on Elasticsearch and MongoDB), was freely accessible for at least 11 days.<\/a><\/noindex> Based on indirect signs, a hypothesis was made regarding the possible owner of the database: all (5042) users from the collection <\/p>\n
<\/p>\n
\"All <\/p>\n
<\/p>\n
had email addresses on the domains users <\/em>@poslogic.pro and @<\/em> finservice.proand additionally, the database's IP address differed by only 1 from the IP address of the site<\/em> www.finservice.pro Finservice has been operational since 2012 and is a leading independent financial broker in the area of POS lending in the Russian market. Currently, Finservice is part of a large diversified holding and employs over 200 staff, actively expanding into all regions of Russia.<\/em>.<\/p>\n
<\/p>\n
On the website Finservice has been operational since 2012 and is a leading independent financial broker in the area of POS lending in the Russian market. Currently, Finservice is part of a large diversified holding and employs over 200 staff, actively expanding into all regions of Russia.<\/em> it says:<\/p>\n
<\/p>\n
We are the developer and rights holder of a leading POS lending platform in the market\u2014Poslogic. The platform is integrated with all leading banks in this segment and allows for the optimization of processes related to consumer loan issuance, increasing the revenue of retail organizations, and satisfying any client requests.
\nI Googled what POS lending is (information from<\/p><\/blockquote>\n
www.banki.ru POS lending (POS \u2013 Point Of Sale) is a direction in retail banking business providing loans for specific goods directly at retail points. This business is considered highly profitable but also high-risk. Typically, such loans have high interest rates\u2014over 30%\u2014but at the same time, quick decisions (within an hour) are made.<\/em>):<\/p>\n
<\/p>\n
POS financing (POS \u2014 Point Of Sale) is a retail banking business model that involves issuing loans for specific goods directly at points of sale. This business is considered highly lucrative but also high-risk. Typically, such loans are characterized by high interest rates\u2014over 30%\u2014but at the same time, decisions are made quickly (within an hour).<\/p><\/blockquote>\n
The company did not respond to my emails, messages through Facebook Messenger, or public posts on Facebook. Email info@finservice.pro<\/em>, listed on the website, does not work at all, and the social media presence is neglected. I had to search the site for employees' emails and write to them. Of course, no response followed\u2026<\/p>\n
<\/p>\n
However, on March 21 around 5 PM (Moscow time), the database disappeared from public access. I want to emphasize that during the observation, the database was constantly updated and supplemented with new records. For example, in one day there were more than 50 new loan applications.<\/p>\n
<\/p>\n
The database contained:<\/p>\n
<\/p>\n