9M transaction records of Cornerstone Payment Systems found exposed online

An open and non-password protected database containing 9,098,506 records of credit card processing information and Personally Identifiable Information (PII) of the customers of California-based credit card processing company Cornerstone Payment Systems was discovered online by security researcher Jeremiah Fowler and the Website Planet research team.

A folder named “Transactions” contained internal transaction log records that included merchant names, partial credit card numbers, payee names, expiration dates, email addresses, security or access tokens, users, email addresses, physical addresses, phone numbers, and much more.

Most transactions concerned gifts or recurring payments to charities, nonprofit organizations, or religious institutions. Donors, marked as “anonymous” sometimes, had their names, email addresses, and comments regarding their donations displayed in clear text.

The researchers said that as soon as the data was discovered, they sent a disclosure notice to Cornerstone, and public access was restricted the same day. They added that Cornerstone acted fast and professionally and thanked the researchers for identifying and reporting the exposure.

The researchers also said that credit and financial data are highly sensitive because a vast majority of cybercrime is financially motivated. Cybercriminals could theoretically create profiles of those people based on their religious affiliation or the causes they are passionate about if they have access to this data. Then, these criminals might carry out a highly focused phishing attack or social engineering scam. Notably, 98% of cyberattacks reportedly involve social engineering in some way. According to the researchers, this dataset made available to the public could have been a goldmine for cybercriminals to exploit.

Cornerstone is a registered independent sales organization (ISO) of Deutsche Bank, USA that provides merchant processing for businesses and groups.