Database exposes names of risky potential bank customers

Convicted criminals and people susceptible to extortion are named in a LexisNexis database that leaked onto the open internet.

Laura Hautala Former Senior Writer
Laura wrote about e-commerce and Amazon, and she occasionally covered cool science topics. Previously, she broke down cybersecurity and privacy issues for CNET readers. Laura is based in Tacoma, Washington, and was into sourdough before the pandemic.
Expertise E-commerce | Amazon | Earned wage access | Online marketplaces | Direct to consumer | Unions | Labor and employment | Supply chain | Cybersecurity | Privacy | Stalkerware | Hacking Credentials
  • 2022 Eddie Award for a single article in consumer technology
Laura Hautala
2 min read

A LexisNexis database of people convicted of crimes or who might be susceptible to bribery leaked onto the open internet.

Graphic by Pixabay/Illustration by CNET

If your name's on this list, banks will treat you with extreme caution. The database is supposed to be private, but it was found online, accessible to anyone with a web browser, a security researcher said Friday.

Called WorldCompliance Data, it's LexisNexis' proprietary database that warns financial institutions when potential customers have been convicted of financial crimes or might be susceptible to bribery.

The database contained more than 4.5 million records, said Bob Diachenko, the researcher who found it. Based on a sample of the data seen by CNET, the database revealed people's names, ages and country, as well as any criminal convictions or status as a "politically exposed person." Called PEPs, these are people, often in governments, who might be targets of extortion or bribery attempts. The exposed database has been secured since Diachenko discovered it and alerted LexisNexis and the cloud service provider, Google.

The exposure is part of a larger problem of misconfigured databases, which have leaked everything from the health care records of drug rehabilitation patients to the expected salaries of job seekers. As organizations around the world move their data to cloud servers, not all of them have the expertise to lock the data behind a password. A group of researchers around the world looks for the databases using special search techniques and custom software, trying to help get the data secured when they find it. But hackers can use the same tools, making the exposures risky.

This is the third dataset containing high-risk banking customers that Diachenko has discovered. In February, he said he discovered Dow Jones' Watchlist, which contains similar records, exposed on the internet. In July, he detailed findings of a dataset that appeared to contain records from a variety of sources, including LexisNexis.

LexisNexis didn't immediately respond to a request for comment. Diachenko noted that it's unclear which organization maintained the version of the database that was exposed. For example, a bank or other organization that pays for access to the data may have been the source of the exposure.

Criminal convictions listed in the sample seen by CNET included wire fraud, human trafficking and tax evasion.

Watch this: A database with info on 80M+ US households was left open to the public