MagnifyMoney.com sharing personal information** loan request from Vouch, Prosper, The Lending Club

[Anonymous]

I recently received an alert from MyFico.com that my personal information was listed on a website, so I did a simple google search, and found that all my personal information along with lots of others was listed in loan request logs on MagnifyMoney.com (which I'm not a member of) with information from loan requests that I made through Vouch, Prosper, and The Lending Club. I recently sent these request from Credit Karma and Credit Sesame. I don't know which one of these websites are sharing the information. I emailed each of them and requested my information deleted immediately.

If you recently submitted a loan request your information might also be listed in these logs. So be careful when applying with these online loan applications.

http://www.magnifymoney.com/assets/personalloanlog/

[iv]

Looks like they've pulled down the live pages (but copies/caches are still out there, of course), no public announcement from the company yet.  Looks like at a minimum September and October applications were included.

Why yet another company thought storing full data (names, SSNs, addresses, incomes, etc...) in unencrypted, plain-text JSON logfiles, directly under their main webroot directory, without any access control was even on the same planet as good security practice boggles the mind.

Ironically, their company Twitter feed this week included this gem "For new companies, any breach early could be catastrophic as they build their reputations."

Someone might want to... follow up on that tweet with a few pointed questions.