Credit scores of millions of Americans have been exposed online
Lender used Experian’s API to allow unauthenticated users to check credit scores
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
The credit scores of millions of Americans were left exposed online when a lender misused an API belonging to the credit reporting agencyExperian.
As first reported byKrebs on Security, independent security researcher Bill Demirkapi was shopping around for student loan vendors online when he discovered that he could easily pull up his Experian credit score just by entering only a portion of the information normally required to do so.
Demirkapi was on a site that offered to check his loan eligibility just by entering his name, address and date of birth. Normally when using acredit monitoring service, Americans also need to provide theirsocial security numberto get access to their credit scores.
After providing the necessary information, Demirkapi took a look at the code on the lender’s site and it was then that he found that the company had been invoking Experian’s API. He provided more details on the significance of his discovery in a statement toKrebs on Security, saying:
“No one should be able to perform an Experian credit check with only publicly available information. Experian should mandate non-public information for promotional inquiries, otherwise an attacker who found a single vulnerability in a vendor could easily abuse Experian’s system.”
Exposing Experian’s API
To make matters worse, Demirkapi also found that the Experian API being invoked on this particular lender’s website could be accessed without any sort ofauthentication. In fact, he was even able to enter all zeros on the site’s date of birth field to pull a person’s credit score.
From here, Demirkapi built his owncommand-line toolto speed up these lookups which he named “Bill’s Cool Credit Score Lookup Utility”. Besides being able to pull a person’s credit score, the Experian API also provides information on up to four “risk factors” that could explain why their score isn’t higher.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
In the end, Demirkapi reached out to Experian and the company was able to discover which lender was exposing its API online. In a statement, Experian explained that it takes data security and matters such as this very seriously, saying:
“We have been able to confirm a single instance of where this situation has occurred and have taken steps to alert our partner and resolve the matter. While the situation did not implicate or compromise any of Experian’s systems, we take this matter very seriously. Data security has always been, and always will be, our highest priority.”
ViaKrebs on Security
After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.
Cisco issues patch to fix serious flaw allowing possible industrial systems takeover
Washington state court systems taken offline following cyberattack
Your doctor may have an AI assistant taking notes during your next Zoom call
