Unsecured Database Linked to Navy Federal Credit Union Exposed Online

Cybersecurity researcher Jeremiah Fowler has revealed a significant data exposure involving a massive, unprotected database potentially linked to Navy Federal Credit Union (NFCU), the largest credit union in the United States serving military personnel, veterans and their families. The unencrypted backup data amounted to 378 GB across 14 backup files in .gz, .sql and .twbx formats, publicly accessible before Fowler restricted the database within hours.

In a limited sampling, Fowler observed internal users’ names, email addresses and what appeared to be hashed passwords and keys, with operational metadata, system logs and sensitive business logic such as product tiers, optimisation processes and rate structures also exposed. Although the records were not confirmed to belong directly to NFCU, information from the database name and internal files suggested they pertained to NFCU in Virginia.

Fowler warned that attackers could use basic internal information to target staff or accounts with credential stuffing, phishing or other social engineering, and noted that the Tableau workbook documents contained table names, field structures, server details and KPI formulas that could help map internal systems. He advised encrypting all backup data with modern algorithms such as AES-256 and never storing encryption keys in the same database as the backups.