QuickBit leaks 300,000 customer records via unprotected database

Getting your Trinity Audio player ready...

QuickBit, a Swedish cryptocurrency exchange, has leaked over 300,000 customer records through an unprotected database. According to a press release by the company, the leak took place after the exchange adopted a third-party system for supplementary screening of customers.

The leak was first detected when Shodan, a security aggregator, indexed the existence of the open MongoDB database. As revealed by Paul Bischoff, Comparitech discovered the exposed data on July 2, with one of the security researchers at the cybersecurity firm notifying QuickBit. The exchange went on to pull the exposed database offline and released a report detailing the issue.

The exposed database held 301,470 events records. An event in this case translates to any transaction that has been conducted on QuickBit’s platform. The information exposed for each event included full names, addresses, email addresses, gender, date of birth, payment information such as the type of credit card used, the source currency and transaction amount.

While these records can’t be used to cause significant harm to the account users, Comparitech research discovered that 143 of the exposed records contained internal credentials. These include secret keys, passwords, user IDs, secret phrases and other such sensitive information. These are the records that pose the most danger, the security researchers stated. Part of the report stated:

Depending on the platform setup and who this information pertains to, this data could potentially give malicious parties full access to registered accounts. As a result, anyone who obtained the data may be able to take over the account, carry out transactions, or view full payment information that can be used in credit card fraud. Criminals may even be able to access cryptocurrency balances held by the users involved.

The security researchers further suggested a few cautionary measures that QuickBit users can take to ensure their accounts are safe. They include changing the account password and checking for any suspicious activities. The report concluded, “As an extra precaution, you may want to cancel your credit card associated with the account, and if you store cryptocurrency funds in a QuickBit wallet, you might want to move them to another service. At the very least, it would be prudent to keep a close eye on your credit card activity and look out for suspicious login attempts and phishing emails.”