- Breach by SL Data Services has exposed 600,000 personal records
- Records include full names, addresses, and financial information
- The database was not password protected
A database belonging to SL Data Services containing hundreds of thousands of records has been discovered online to be publicly exposed and not password-protected or encrypted.
Over 640,000 records (713.1GB) PDF files were discovered by cybersecurity researcher Jeremiah Fowler, who revealed this included vehicle records, court records, and property ownership reports. The documents were primarily labelled ‘background checks’, and included full names, addresses, email addresses, employment details, social media accounts, phone numbers, and criminal records.
It’s not clear how long the information was openly accessible, but after the responsible disclosure notice was sent, the information was restricted one week later. The database may belong to a third-party contractor, or directly by SL Data Services.
Background check information
Since the vast majority of the exposed information was from background checks, there is a very real possibility that these were conducted without the knowledge or consent of the individual whose information was exposed.
This leaves many people vulnerable, especially to social engineering attacks, as criminals could easily leverage sensitive information to trick victims, using information about family members, financial information, or employment records.
With such extensive personally identifiable information exposed, there’s also a risk of identity theft, exposing victims to serious financial loss.
There’s no indication yet that criminals accessed the open database or collected any sensitive information, but now that the information has been restricted, researchers will likely monitor the dark web to see if any of the data is listed for sale.
This isn’t the first data breach this year from a background check company, as National Public Data suffered one of the biggest data breaches ever back in August 2024, and is now facing a class action lawsuit for failing to protect personal records.