Over 752,000 US birth certificate applications leaked

According to a report from TechCrunch, an online company that allowed Americans to obtain birth/death certificates was leaked. More than 752,000 copies of birth certificates for Americans have been found in Amazon Web Services (AWS) repositories, and there are 90,400 death certificate applications that are not accessible or downloadable. Fidus Information Security, a UK-based penetration testing company, found exposed data.

The repository is not password protected and anyone can access this data via a URL that is very easy to guess. Although the U.S. state’s application process varies, it does the same task: allows Americans to apply to the state’s record-keeping agency (usually the state health department) to obtain a copy of their history. The application we can review contains the applicant’s name, date of birth, current home address, email address, phone number, and historical personal information, including past addresses, names of family members and reasons for the application (such as applying for a passport) or research family history.

According to a survey of the data, it was found that these applications can be traced back to the end of 2017 at the earliest and that the repository is updated daily. In just one week, the company added nearly 9,000 application records to the repository.