Over 750 million records exposed by ERP firm data breach — find out if you're safe

Data leak
(Image credit: Shutterstock)

A major Enterprise Resource Planning (ERP) firm from Mexico kept an unprotected database containing sensitive information on hundreds of thousands of users online for anyone to view.

A report from cybersecurity researcher Jeremiah Fowler, who discovered the archive and reported his findings to Website Planet, noted the database, available to anyone who knew where to look, contained 769 million records. 

These records contained secrets and personally identifiable information, such as API keys, secret keys, bank account numbers, tax identification numbers, and email addresses. The database is 395GB heavy, and belongs to ClickBalance, a software provider offering various cloud-based business services that help with administration automation, accounting, inventory, payroll, and more.

Disruptive potential

Website Planet describes ClickBalance as one of Mexico’s largest ERP technology providers, and as soon as Fowler found the archive and pinpointed its owner, he reached out to the company, which locked it down “within hours.” 

Still, it is not known if any malicious players had already discovered it, and whether or not they already used the data in any of their campaigns. Only a detailed forensic investigation can determine that, Fowler argues.

While obtaining tax identification numbers, or bank account numbers, is certainly dangerous, and allows cybercriminals to run fraud campaigns, especially on those without identity theft protection, stealing active email addresses is arguably more valuable, since it allows them to mount phishing attacks through which they can deploy malware, and even ransomware.

Unprotected databases continue to be one of the most common causes of data leaks, despite their disruptive potential. Many large enterprises and government organizations were found to have kept online databases without any safeguards. In one such instance, the entire Brazilian population had their personal information leaked. 

In early January 2024, researchers from Cybernews discovered an unprotected database that held personal information on approximately 223 million Brazilian citizens.

More from TechRadar Pro

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
Cartoon Phishing
One of the largest data leaks ever sees info on 1.5 billion people leaked online
Data leak
Top collectibles site leaks personal data of nearly a million users
Data leak
Popular online bill paying site leaks data of thousands of users
healthcare
Over a million clinical records exposed in data breach
A graphic showing fleet tracking locations over a city.
Lost & Found tracking site hit by major data breach - over 800,000 could be affected
No broadband network
Massive online data breach sees 2.7 billion records leaked - here's what we know
Latest in Security
Data leak
Top home hardware firm data leak could see millions of customers affected
Representational image depecting cybersecurity protection
Third-party security issues could be the biggest threat facing your business
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Broadcom warns of worrying security flaws affecting VMware tools
Android Logo
Devious new Android malware uses a Microsoft tool to avoid being spotted
URL phishing
HaveIBeenPwned owner suffers phishing attack that stole his Mailchimp mailing list
Ransomware
Cl0p resurgence drives ransomware attacks to new highs in 2025
Latest in News
Buzz Lightyear Space Ranger Spin Rennovations
Disney’s giving a classic Buzz Lightyear ride a tech overhaul – here's everything you need to know
Hisense U8 series TV on wall in living room
Hisense announces 2025 mini-LED TV lineup, with screen sizes up to 100 inches – and a surprising smart TV switch
Nintendo Music teaser art
Nintendo Music expands its library with songs from Kirby and the Forgotten Land and Tetris
Opera AI Tabs
Opera's new AI feature brings order to your browser tab chaos
An image of Pro-Ject's Flatten it closed and opened
Pro-Ject’s new vinyl flattener will fix any warped LPs you inadvertently buy on Record Store Day
The iPhone 16 Pro on a grey background
iPhone 17 Pro tipped to get 8K video recording – but I want these 3 video features instead