2023 Promtransbank — ESIA data exposure
Data compromised
ESIA authentication data, loan applicant info
Technical writeup
Contractor error: Promtransbank saved ESIA (unified auth) data to public esia.log file. Data of loan applicants from Nov 2022 updated in real time. Hacker group exploited vulnerability.
Root cause
Contractor misconfiguration; data in public directory