Navy Federal Credit Union data leaked by misconfiguration

Major U.S. military-focused credit union Navy Federal Credit Union had 378 GB of data leaked by an unprotected database, HackRead reports.

Included in the misconfigured server were unencrypted backup information, such as internal usernames, email addresses, hashed credentials, and multiple Tableau workbook files, according to an analysis by cybersecurity researcher Jeremiah Fowler published on Website Planet.

Despite the absence of plaintext credit union member details, such information could still be exploited by threat actors in subsequent phishing and identity theft attacks, said Fowler, who noted that the server was promptly secured following notification to the NFCU.

“These files can sometimes be just a representation of the production data, but they still may reveal underlying structures or metadata that indicate how the backup software associates or connects these files to production systems,” Fowler added.

Organizations have been urged to strengthen backup data security via encryption and routine audits following the incident.