Researcher dicovers SL Data Services/Propertyrec data leak exposing 600k records
Learn More
A data leak incident was discovered by cybersecurity researcher Jeremiah Fowler involving SL Data Services/Propertyrec, an information research provider (data broker) specializing in real estate ownership data and criminal records search information.
The company operates through approximately 16 different websites offering various information services.
The incident involved an unsecured, non-password-protected database that was publicly accessible. During the period between discovery and securing the database, the number of exposed records grew from 513,876 to 664,934 documents, representing an increase of 151,058 records. The database contained 644,869 PDF files (713.1 GB) including:
- Full names (first, middle, and last)
- Home addresses
- Phone numbers
- Email addresses
- Employment information
- Family member details
- Social media accounts
- Criminal record histories
- Court records
- Vehicle records (license plates and VIN numbers)
- Property ownership reports
- Background check documents (comprising approximately 95% of the sample reviewed)
Fowler sent a responsible disclosure notice to the company. However, the database remained exposed for over a week after the initial disclosure before access was restricted and no response was received from SL Data Services/Propertyrec.
The company has not disclosed whether they conducted an internal forensic audit to identify potential unauthorized access during the exposure period.
The exposed information could potentially be used for:
- Targeted phishing attempts
- Social engineering attacks
- Identity theft and impersonation
- Privacy violations through the compilation of detailed personal profiles
This incident follows the National Public Data breach from August 2024, a concerning trend in the exposure of background check and personal information databases.
