Database of Income Property Investments data discovered unprotected, exposing surveillance and employee records
Learn More
A California-based real estate investment and management company has been found to be leaking sensitive information belonging to motel guests, employees, and property operations across multiple states.
The leak was caused by an internet exposed database with no password protection containing 170,360 records with a total size of 116.24GB. It was discovered by cybersecurity researcher Jeremiah Fowler and reported to Website Planet.
The vast majority of compromised documents were hotel-related, with a smaller portion linked to residential housing operations. The repository appeared to function as an upload storage system designed for hotel staff, management, property managers, and other authorized personnel to transmit documents and information to corporate offices for senior management review.
The exposed database appeared to belong to Income Property Investments Inc., a California-based real estate investment and management company. Exposed data includes:
- Employee personally identifiable information (names, addresses, email addresses, dates of birth)
- Social Security numbers stored in plain text
- Police reports containing arrest details of guests and hotel employees
- Surveillance videos and images of incidents involving guests and employees
- Documentation of accidents and falls, including visual evidence
- Proof of illness documents indicating positive COVID-19 tests and medical issues
- Property inspection reports and maintenance documentation
- Notices to vacate and eviction proceedings
- Employee termination and demotion letters
- Petty cash statements and expense reports
- Payment card information including last four digits and card types
- Images documenting property damage to rooms, common areas, and parking lots
The number of individual employees, guests, or customers impacted has not been disclosed.
Fowler sent a responsible disclosure notice to Income Property Investments, and public access was restricted the same day. It's not clear whether the database was owned and managed directly by Income Property Investments or by a third-party contractor handling data processing services. The duration of the exposure prior to discovery has not been disclosed.
Income Property Investments has not publicly responded to requests for additional comment. No details have been disclosed about whether the company has conducted internal forensic audits to determine if additional access occurred or whether law enforcement has been notified of the exposure.
