Security experts from vpnMentor have discovered two corporate finance companies that leak half a million legal and financial documents online

vpnMentor experts uncovered a database exposed online on Amazon Web Services (AWS) that is leaking a huge amount of sensitive legal and financial documents.

“Whatever the intended purpose of this database was, over 500,000 highly sensitive and private legal and financial documents were exposed, compromising numerous parties to the risk of fraud and theft.” reads the post published by vpnMentor.

The database appears to belong to MCA Wizard, an iOS and Android app developed by two companies: Advantage Capital Funding and Argus Capital Funding. The application was launched in January 2018, but it is currently no longer available for download.

Advantage and Argus seem to be the same company working under two different names, they offer funding and startup capital to business owners without access to traditional lending and financial services.

The researchers discovered the unsecured database in December 2019.

After the initial analysis, the experts were able to link the database to the two companies that unfortunately did not respond to any contact.

Then the researchers contacted AWS directly that secured the S3 bucket. Below the timeline of the discovery:

Date discovered: 24/12Date vendors contacted: 30/12Date of contact with AWS: 7/01Date of Action: 9/01At the time of the discovery, the database contained over 500,000 documents for a total of 425GB of data. The documents were covering many aspects of Advantage and Argus’s businesses, finances, and dealings with other companies, they included:

Credit reportsBank statementsContractsLegal paperworkDriver’s licensesPurchase orders and receiptsTax returnsTransaction reports for credit cards and merchant bank accountsScanned copies of bank checksAccess information for bank accountsCorporate shares outlineSocial Security information“This leak raises serious credibility and trust issues for Advantage and Argus. By not sufficiently securing this database and revealing so much information, they have compromised the safety, privacy, and security of their clients, partners, and customers.” concludes vpnMentor.

“Furthermore, a leak like this may attract the attention of US financial and data security regulators.” 

window._mNHandle = window._mNHandle || {};
window._mNHandle.queue = window._mNHandle.queue || [];
medianet_versionId = “3121199”;

try {
window._mNHandle.queue.push(function () {
window._mNDetails.loadTag(“762221962”, “300×250”, “762221962”);
});
}
catch (error) {}

Pierluigi Paganini

(SecurityAffairs – financial documents, cybercrime)

The post Corporate Finance firms leak 500K+ legal and financial documents online appeared first on Security Affairs.