[Breaches](/breaches) Credit Crunch: Detailed Financial Histories Exposed for Thousands [Blog](/blog)[Breaches](/breaches)[Resources](/resources)[News](/news) # Credit Crunch: Detailed Financial Histories Exposed for Thousands ##### [UpGuard Team](/team/upguard) Published Nov 30, 2017 ##### Join 27,000+ cybersecurity newsletter subscribers *While this blog post provides a description of a data exposure discovery involving National Credit Federation, this is no longer an active *[*data breach*](https://www.upguard.com/blog/data-breach)*. As soon as the UpGuard Cyber Risk Team notified National Credit Federation of this publicly exposed information, immediate action was taken, securing the open buckets and preventing further access.  * Coming only months after the revelation that the personal information of [over 143 million Americans had been stolen from the systems of credit agency Equifax](https://www.nytimes.com/2017/09/07/business/equifax-cyberattack.html?_r=0), the UpGuard Cyber Risk Team has discovered a new, damaging exposure from within a financial firm, which, beyond revealing critical internal data, also exposes customer information compiled by all three major credit agencies. This highly concentrated level of exposure, thoroughly revealing customer credit history several times over, serves to highlight the myriad dangers a single exposure can unleash. 111 GB of internal customer information from [National Credit Federation](https://nationalcreditfederation.com/), a Tampa, Florida-based credit repair service, was left exposed in a publicly downloadable data repository, revealing to the public internet sensitive personal and financial information for tens of thousands of customers. Exposed among the leaked files were such sensitive documents and details as customer names, addresses, dates of birth, driver’s license and Social Security card images, credit reports from all three major agencies, personalized credit blueprints containing detailed financial histories, and full credit card and bank account numbers. While there is fortunately nothing to indicate any such theft of data by malicious actors in this case, National Credit Federation data was left entirely accessible to anybody accessing the repository’s URL, highlighting the vital urgency for enterprises to secure their data and validate their configurations against any such exposures. ## The Discovery On October 3rd, 2017, UpGuard Director of Cyber Risk Research Chris Vickery discovered an Amazon Web Services S3 cloud storage bucket [configured for public access](https://www.upguard.com/blog/check-your-amazon-s3-permissions-someone-will), allowing any web user entering the repository’s URL to access and download the bucket’s contents. The bucket’s subdomain, “crm-mvp,” likely refers to “customer record management” or “[customer relationship management](https://www.salesforce.com/crm/what-is-crm/),” theories seemingly corroborated by the repository’s contents: forty-seven thousand files, most of them PDF and text documents, containing the sensitive information of National Credit Federation customers. The files appear to have been compiled during the process National Credit Federation customers go through with the firm, [as described on the company’s website](https://nationalcreditfederation.com/): initially, discussion with NCF representatives about the customer’s financial situation, followed by disputes of customer credit report items with the aim of improving the customer’s credit score. As such, three general pools of data live in the exposed repository: documents submitted by customers to NCF providing their personal and financial details, “personalized credit blueprints” and videos created by NCF for their customers, and customer credit reports from Equifax, Experian, and TransUnion - the “big three” credit reporting agencies. The personal documents submitted by customers to NCF are expansive and highly sensitive; their exposure left tens of thousands of individuals entirely compromised against the threats of identity theft and financial attack. Photographs and scans of customers’ driver’s licenses, as well as completed forms and documents, provide sensitive [personal details such as full names, dates of birth, addresses, and financial histories.](https://www.upguard.com/blog/personally-identifiable-information-pii) There are graver exposures within the repository. Photographs and scans of Social Security cards reveal full customer Social Security numbers, while other submitted documents contain full customer bank account and credit card numbers. All of this data could be easily used by malicious actors to steal identities and compromise the personal finances of NCF customers. Content in the repository apparently created by NCF include personalized credit blueprints compiling a great deal of sensitive customer data in one form - everything from who owns a mortgage to how regularly a customer paid their credit card bills. Video files within the repository depict NCF employee computer desktops, recorded using a screen logging program, as an employee accesses customer records and explains the significance. The videos appear to be specially made for individual customers, and are rife with the depiction of personally identifying information. Finally, the repository contains thousands of customer credit reports compiled by Equifax, Experian, and TransUnion, running down the personal financial histories of each customer, in some cases multiple times. ## The Significance The presence of Equifax credit reports within this exposed repository is an unfortunate echo of the credit agency’s breach earlier this year by malicious actors who succeeded in stealing the personal and financial details of virtually every American adult. While the scale of those affected by this incident is fortunately much smaller, the NCF data exposure is indication of just how widespread cyber risk is among small and mid-sized financial enterprises. The presence of third-party enterprises in this exposure, such as Equifax, further speaks to the increasingly chaotic conditions under which one enterprise’s exposure can wreak havoc across multiple entities. How many more buckets of this type, containing the most compromising personal and financial details imaginable, are out there, totally unsecured and awaiting discovery by the first bad guy to find them? A conservative estimate of the number of NCF customers affected by this exposure would be below forty thousand individuals, all of whom needed help in restoring their finances. In short, these are people who needed and asked for assistance in getting their lives back on track, and were repaid, through a process still unknown, by having the information they furnished revealed online. The unsecured bucket was being continually updated until UpGuard’s discovery and subsequent notification of NCF, raising the specter of malicious actors simply sitting and waiting as a fresh supply of victims flowed into their grasp. This exposure could have affected you or a family member who chose to trust this enterprise with their data - an unavoidable choice for anybody seeking to participate in the economy today. The total lack of protection of these people’s data, the remarkably simple means held by any internet user to find and download the information, and the [sensitivity of the information](https://www.upguard.com/blog/sensitive-data) contained therein, speaks to the real challenges of fostering cyber resilience today. [Security ratings](/blog/what-are-security-ratings) can  begin to help consumers determine whether to trust an enterprise with their information, but this is not enough. In order to ensure that the pandemic of cloud leaks and data exposures of this kind is arrested, enterprises must become serious about investing time and resources into full visibility and control of their systems. ## Protect your organization Get in touch or book a free demo. [Contact sales](/demo) [Free demo](/demo) ## Related breaches Learn more about the latest issues in cybersecurity. [](/breaches/cyber-risks-of-the-2026-world-cup) #### [Own Goal: Inside the Cyber Risks of the 2026 World Cup](/breaches/cyber-risks-of-the-2026-world-cup) Free World Cup streams and black-market betting sites are leaking fan data. UpGuard research reveals the hidden cyber risks of the 2026 tournament. [](/team/greg-pollock) [Greg Pollock](/team/greg-pollock) June 30, 2026 [](/breaches/social-insecurity-billions-of-social-security-number-and-passwords) #### [Social Insecurity: Billions of Social Security Number and Passwords](/breaches/social-insecurity-billions-of-social-security-number-and-passwords) UpGuard research found a trove of sensitive information in an exposed Elastic database. Getting to the bottom of what it meant led us down an interesting path. [](/team/greg-pollock) [Greg Pollock](/team/greg-pollock) February 18, 2026 [](/breaches/angelsense-data-leak) #### [Sixth Sense: GPS and AI Data Exposed for Assistive Devices](/breaches/angelsense-data-leak) UpGuard can now report that it has secured an Elasticsearch database for AngelSense, a GPS tracker for children and adults with special needs. [](/team/upguard) [UpGuard Team](/team/upguard) January 30, 2025 [](/breaches/pta-database) #### [Stolen Data: National PTA Database Available on Dark Web](/breaches/pta-database) On May 13th, UpGuard discovered a new set of data recently posted on a prominent dark web forum, this time allegedly belonging to the National Parent Teacher Association. [](/team/upguard) [UpGuard Team](/team/upguard) May 14, 2024 [](/breaches/smarterselect) #### [Student Applications: How an Education Software Company Exposed Millions of Files](/breaches/smarterselect) UpGuard can now report that a public Google Cloud Storage bucket containing approximately 1.5 terabytes of data used to administer funding programs for college students has been secured. The bucket belonged to SmarterSelect, a company that provides software for managing the application process for scholarships, grants, and awards. The more than 2.8 million files included documents like transcripts, resumes, personal essays, tax returns, and invoices for approximately 1.2 million applications to funding programs. [](/team/upguard) [UpGuard Team](/team/upguard) November 22, 2021 [](/breaches/power-apps) #### [By Design: How Default Permissions on Microsoft Power Apps Exposed Millions](/breaches/power-apps) 38 million records were exposed in multiple data leaks resulting from misconfigured Microsoft Power Apps portals. Data included sensitive information such as COVID-19 contact tracing data, COVID-19 vaccination appointments, social security numbers for job applicants, employee IDs, and millions of names and email addresses. [](/team/upguard) [UpGuard Team](/team/upguard) August 23, 2021 [View all breaches](/breaches) ### Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights. ##### Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](/instant-security-score)