- A database containing complete behavioral and monetary profiles of individuals and companies was left unsecured on-line
- Researchers declare it belongs to a Danish fintech agency
- The agency denies having something to do with the archive
An unlimited database, containing hundreds of thousands of extremely delicate info on Swedish residents, was sitting on the open web, out there for anybody who knew the place to look.
Cybernews researchers not too long ago uncovered a misconfigured Elasticsearch server which they described as a “goldmine of enterprise intelligence information”, containing lots of of hundreds of thousands of extremely detailed data belonging to Swedish people and organizations.
It was attributed it to a enterprise intelligence specialist, however the firm denied having something to do with the archive.
Who owns the information?
In whole, the information created an in depth monetary and behavioral profile of each residents, and organizations, in Sweden.
General, it contained greater than 100 million information data, generated between 2019 and 2024, and unfold throughout 25 indices.
This contained individuals’s names (together with historical past of earlier names), Swedish private identification numbers, dates of start, gender, handle historical past (each regionally and overseas), civil standing, details about deceased people, international addresses (for emigrants), debt data, fee remarks, chapter historical past, property possession indicators, earnings tax, exercise and occasion logs, monetary information, and behavioral information.
Cybernews’ researchers attributed the server to Risika, a Danish fintech firm providing real-time credit score evaluation, threat monitoring, and monetary threat intelligence for companies.
They declare using inner “dwh*” tags, and product-oriented index names “matched the conventions of recognized Risika merchandise”.
Nevertheless, the researchers additionally declare the database was possible operated by a downstream third-party, after Risika “legitimately supplied” the information underneath a business license, “solely to be misconfigured and left uncovered”.
The researchers reached out to Risika, and the database was locked down the next day.
Within the meantime, the corporate replied, stating that it had nothing to do with the archives:
“Our preliminary investigation signifies that the information referenced within the reported leak accommodates info that we don’t personal, retailer, or have entry to by way of our enterprise operations. This implies that our methods usually are not the supply of this specific information breach,” the corporate’s spokesperson informed the researchers.
