Authorization

Credit Karma glitch exposed users to other peoples accounts

Users of credit monitoring site Credit Karmas have complained that they were served other peoples account information when they logged in.
Many took to a Reddit thread and complained on Twitter about the apparent security lapse.
First time logging in it gave me my information, but as soon as I refreshed the screen, it gave me someone elses info, said one Reddit user. Refreshed again and bam! someone elses info its like roulette. Another user said they logged in and out several times and each time they had full access to a different random persons credit file, they said.
One user told TechCrunch that after they were served another persons full credit report, they messaged the user on LinkedIn to let him know his data was compromised.
Another user told us this:
The reports are split into two sections: Credit Factors things like number of accounts, inquiries, utilization; and Credit Reports personal information like name, address, etc.. The Credit Reports section was my own information, but the Credit Factors section definitely wasnt. It listed four credit card accounts (I have more like 20 on my report), a missed payment (Im 100% on time with payments), a Honda auto loan (never had one with Honda), student loan financing (mine are paid off and too old to appear on my report), and cards with an issuer that I have no relationship with (Discover).
Several screenshots seen by TechCrunch show other peoples accounts, including details about their credit card accounts and their current balance.
Another user who was affected said they could read another persons Credit Factors including derogatory credit marks but that the Credit Report tab with that users personal information, like names and addresses, was blank.
One user said that the login page was pulled offline for a brief period. Well be right back, the login page read instead.
Credit Karma spokesperson Emily Donohue denied there was a data breach, but when asked would not say how many customers were affected.
What our members experienced this morning was a technical malfunction that has now been fixed. There is no evidence of a data breach, the statement said.
The company didnt say for how long customers were experiencing issues.
Credit Karma offers customers free credit score monitoring and reports. The company allows users to check their scores against several major credit agencies, including Equifax, which last month was fined at least $575 million for a 2017 data breach.

FTC slaps Equifax with a fine of up to $700M for 2017 data breach
See also:
Leave a comment
News
  • Latest
  • Read
  • Commented
Calendar Content
«     2019    »
 1234
567891011
12131415161718
19202122232425
262728293031