VAT Refund Giant MoneyBack Exposes Half-Million Passports, Credit Cards Online Tara Seals - Infosecurity Magazine
go to original September 10, 2017

If you’ve ever gone on holiday to Mexico and done a little shopping, then you know you can apply for a value-added tax (VAT) refund on the goods you’re taking back home. Unfortunately, one of the largest companies that does that, the appropriately named MoneyBack, has laid open its users’ information to bad actors.

According to the Kromtech Security Research Center, MoneyBack has fallen prey to the all too common mistake of leaving a misconfigured database open to the public web (it has since been secured). The CouchDB database contains passport information, credit card numbers, travel tickets and various other credentials for nearly a half-million customers, all of which was left accessible to anyone that stumbled across it.

Kromtech said that the potentially leaked data totals more than 400GB - none of which required password protection or other authentication to view or download. The information could be used to commit identity fraud or craft spearphishing gambits; or, the credit card numbers could be sold or used for fraudulent purchases.



Chances are that tourists who have visited south of the border and applied for a VAT refund in the last year could be impacted: MoneyBack is pretty much everywhere in Mexico. The company’s general director, Danielle Van Der Kwartel, told the firm that there are 6,500 MoneyBack affiliated stores; and, they provide service in more than 98% of Mexico’s airports and cruise ship docking points, plus offices and shopping mall locations.

The data includes 455,038 scanned documents, including 88,623 unique passport numbers. Researchers identified impacted passports from the US, Canada, Argentina, Colombia, Italy and elsewhere around the globe - the analysis suggests that every client that has used MoneyBack services between 2016 and 2017 was exposed.

Read the rest at Infosecurity Magazine

Related: Equifax Data Leak: How to find Out if You’re Among the 143 Million Victims — and Protect Your Credit (Mic)

We invite you to add your charity or supporting organizations' news stories and coming events to PVAngels so we can share them with the world. Do it now!