ClaimPix Data Exposure: 10TB of Insurance Records, Vehicle Data, and Legal Documents Left Unprotected

Cybersecurity researcher Jeremiah Fowler uncovered a massive unprotected database containing sensitive insurance and vehicle records linked to Illinois-based ClaimPix. The exposed dataset comprised over 5,170,256 files and images, totalling 10TB, including powers of attorney, vehicle registrations, repair invoices, and images of damaged vehicles with visible licence plates and VIN numbers. Fowler said the publicly exposed database was not password-protected or encrypted.

A sampling of files revealed personal information such as names, addresses, phone numbers, emails, VINs, vehicle year, make and model, and thousands of powers of attorney documents, some containing IP addresses of signatories. ClaimPix acknowledged the issue, stating they had investigated and updated policies and their code, with changes to go live later that evening.

Fowler advised encrypting sensitive data, enforcing access controls with multi-factor authentication, and conducting regular cloud storage audits to limit public access, while individuals should monitor for identity theft and consider fraud alerts or credit freezes where necessary. 24 September 2025.