Cybersecurity researchers uncovered an unsecured MongoDB database containing over four million sensitive records linked to FinansCepte and FinansWebde, two widely used financial apps in Turkey. These platforms help more than a million users manage investments, track markets, and monitor personal finances.
The exposed data includes usernames, email addresses, phone numbers, partial payment details, hashed passwords, and financial alert settings. It remains unclear how long the database was publicly accessible or whether attackers have already exploited it. However, given how frequently threat actors scan for open databases, the risk is high.
Leaked financial data can lead to targeted phishing campaigns, where attackers impersonate app communications to steal credentials and access accounts. Even hashed passwords can be used in brute-force or credential stuffing attacks. Alert settings could also be manipulated to mislead users about market changes.
Leaving databases unprotected is a common error, often caused by simple misconfigurations. Cybernews has documented similar incidents, including a 2024 breach at Nigerian FinTech firm BestFin, which exposed nearly 850,000 users and their private messages. Another leak from Uruguay-based Bankingly affected seven financial institutions and nearly 100,000 individuals across Latin America.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
