Rockerbox tax credit consultancy leaks 245 K client records
Learn More
Screen Technologies LLC, operating as Rockerbox.tech, a Dallas-based tax credit consulting firm, was found to be leaking customer data by the cybersecurity researcher Jeremiah Fowler.
Rockerbox is a tax credit consulting company that helps businesses across the United States identify and manage employer-focused tax incentives through programs including the Work Opportunity Tax Credit (WOTC), Employee Retention Tax Credit (ERTC), R&D credits, and Empowerment Zone credits.
Fowler discovered an unprotected publicly accessible database containing highly sensitive personal and financial information belonging to the company's clients. The database exposed 245,949 records totaling 286.9 GB of data.
The exposed data includes:
- Names, physical addresses, email addresses, dates of birth, and Social Security numbers in plain text
- Driver's licenses and identification cards
- Social Security number cards
- Work Opportunity Tax Credit documents containing employment and salary information
- Determination letters with acceptance or denial of eligibility decisions
- DD214 forms (Certificates of Release or Discharge from Active Duty) issued by the U.S. Department of Defense
- Employment tax credit forms and internal tracking documents
- Company and employee information including employer EIN tax identification numbers
- Military discharge papers containing rank, pay, and personal information
The total number of affected individuals is not disclosed apart from the total number of records. It's not clear whether one record amounts to one individual. Also it's not clear whether the database was owned and managed directly by Rockerbox or by a third-party contractor, how long the database was exposed before discovery, or if any other unauthorized parties gained access to the information.
Fowler sent a responsible disclosure notice to Rockerbox alerting them to the security issue. The database was restricted from public access several days later. Rockerbox did not reply to the disclosure.
