Navy Federal Credit Union leaks 378 GB of internal backup data in Amazon Cloud misconfiguration

Navy Federal Credit Union (NFCU), the largest credit union in the United States serving military members and their families, was found to be leaking 378 gigabytes of internal backup files. 

Navy Federal Credit Union, headquartered in Vienna, Virginia, is a member-owned, not-for-profit financial cooperative exclusively serving military personnel, veterans, and their families across all branches of the armed forces. As of December 2024, the institution manages approximately $180.8 billion in assets and serves 14.5 million members.

The files were left publicly accessible on Amazon's cloud storage service and were discovered by cybersecurity researcher Jeremiah Fowler. The leak was caused by an Amazon S3 bucket that was left publicly accessible without password protection. The bucket contained 14 files in various formats (.gz, .sql, and .twbx) and included:

• Internal user names and email addresses
• Hashed passwords and encryption keys
• System logs and operational metadata
• Business logic and proprietary codes
• Product tiers and rate structures
• Optimization processes and financial performance metrics
• Tableau workbook documents with database connection details
• MySQL table structures and server connection information
• Key performance indicators (KPI) formulas tied to financial performance
• Loan portfolio metrics and lending performance data

The number of affected individuals is not disclosed.

After Fowler sent a responsible disclosure, Navy Federal restricted access to the database within hours. The organization did not respond directly to the researcher's disclosure notice. A Navy Federal spokesperson provided only a brief statement: "At this time, we are unable to share any information regarding this matter."

Although customer information was not directly exposed in plain text, cybersecurity experts warn that the internal data could provide attackers with a blueprint of Navy Federal's operational systems that could be used for social engineering attacks.

Fowler noted that the Tableau workbook documents revealed database table names, field structures, server connection details, and environment configurations marked as "production." This metadata could enable threat actors to understand how the credit union's internal systems function and potentially identify vulnerabilities for future exploitation.