{"id":4137,"date":"2014-10-10T11:10:07","date_gmt":"2014-10-10T15:10:07","guid":{"rendered":"http:\/\/me-en.kaspersky.com\/blog\/?p=4137"},"modified":"2020-02-26T18:59:05","modified_gmt":"2020-02-26T14:59:05","slug":"mbia-bond-insurance-databreach","status":"publish","type":"post","link":"https:\/\/me-en.kaspersky.com\/blog\/mbia-bond-insurance-databreach\/4137\/","title":{"rendered":"Simple Mistake Indexes Highly Sensitive Banking Data"},"content":{"rendered":"

A recent report from Brian Krebs<\/a> underscores an important point: the risk of exposure online, particularly that a person\u2019s sensitive data will be compromised, is increasing. Not alarmingly so, but certainly at times from unpredictable sources.<\/p>\n

\"Simple-Mistake-Indexes-Highly-Sensitive-Banking-Data\"<\/a><\/p>\n

This week, Krebs explained that a bond insurer\u2019s misconfigured server somehow initiated a chain-reaction that ultimately ended with 230 pages of account statements online and indexed by search engines.Those statements are said to include account and routing numbers, balances, dividends and account holder names for the members of a handful of local government investment pools.<\/p>\n

Those statements are said to include account and routing numbers, balances, dividends and account holder names for the members of a handful of local government investment pools.<\/div>\n

The breached bond insurer is a subsidiary of MBIA Inc., which is reportedly the largest provider of bond insurance<\/a> in the United States, called Cutwater Asset Management.<\/p>\n

The good news is that MBIAn Inc. says it has since fixed the problem that led to the breach. Affected customers, according to the companies involved, will have been contacted already.<\/p>\n

The bad news, as is so succinctly described in the Krebs report, is that \u201cthe documents indexed by search engines featured detailed instructions on how to authorize new bank accounts<\/a> for deposits, including the forms and fax numbers needed to submit the account information.\u201d<\/p>\n

Obviously this is a pretty small breach<\/a> compared to recent ones at the Home Depot, Target, JP Morgan and all the others we discussed in the most recent edition of the Talk Security podcast<\/a>.<\/p>\n

The risk of suffering a #databreach is increasing from unexpected sources<\/p>Tweet<\/a><\/blockquote>\n

However, the fact that this breach, which is likely bad for anyone unlucky enough to have been impacted by it, is additionally troubling because it was caused by a simple, seemingly overlooked, server configuration error.<\/p>\n","protected":false},"excerpt":{"rendered":"

A massive provider of insurance for bond investments misconfigured one of its servers and accidentally made a variety of sensitive payment information indexable. <\/p>\n","protected":false},"author":42,"featured_media":4140,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[5],"tags":[813,314,79,812,43,97],"class_list":{"0":"post-4137","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-news","8":"tag-brian-krebs","9":"tag-data-breach","10":"tag-online-banking","11":"tag-payment-data","12":"tag-privacy","13":"tag-security-2"},"hreflang":[{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/mbia-bond-insurance-databreach\/4137\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/mbia-bond-insurance-databreach\/4232\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/mbia-bond-insurance-databreach\/4662\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/mbia-bond-insurance-databreach\/4890\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/mbia-bond-insurance-databreach\/6297\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/mbia-bond-insurance-databreach\/6297\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/mbia-bond-insurance-databreach\/6297\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/me-en.kaspersky.com\/blog\/tag\/brian-krebs\/","name":"brian krebs"},"_links":{"self":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/4137","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/42"}],"replies":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=4137"}],"version-history":[{"count":2,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/4137\/revisions"}],"predecessor-version":[{"id":15928,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/4137\/revisions\/15928"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/4140"}],"wp:attachment":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=4137"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=4137"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=4137"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}