Credit scores of millions of Americans have been exposed online

Banking
(Image credit: Shutterstock)

The credit scores of millions of Americans were left exposed online when a lender misused an API belonging to the credit reporting agency Experian (opens in new tab).

As first reported by Krebs on Security (opens in new tab), independent security researcher Bill Demirkapi was shopping around for student loan vendors online when he discovered that he could easily pull up his Experian credit score just by entering only a portion of the information normally required to do so.

Demirkapi was on a site that offered to check his loan eligibility just by entering his name, address and date of birth. Normally when using a credit monitoring service (opens in new tab), Americans also need to provide their social security number (opens in new tab) to get access to their credit scores.

After providing the necessary information, Demirkapi took a look at the code on the lender's site and it was then that he found that the company had been invoking Experian's API. He provided more details on the significance of his discovery in a statement to Krebs on Security, saying:

“No one should be able to perform an Experian credit check with only publicly available information. Experian should mandate non-public information for promotional inquiries, otherwise an attacker who found a single vulnerability in a vendor could easily abuse Experian’s system.” 

Exposing Experian's API

To make matters worse, Demirkapi also found that the Experian API being invoked on this particular lender's website could be accessed without any sort of authentication (opens in new tab). In fact, he was even able to enter all zeros on the site's date of birth field to pull a person's credit score.

From here, Demirkapi built his own command-line tool (opens in new tab) to speed up these lookups which he named “Bill's Cool Credit Score Lookup Utility”. Besides being able to pull a person's credit score, the Experian API also provides information on up to four “risk factors” that could explain why their score isn't higher.

In the end, Demirkapi reached out to Experian and the company was able to discover which lender was exposing its API online. In a statement, Experian explained that it takes data security and matters such as this very seriously, saying:

“We have been able to confirm a single instance of where this situation has occurred and have taken steps to alert our partner and resolve the matter. While the situation did not implicate or compromise any of Experian’s systems, we take this matter very seriously. Data security has always been, and always will be, our highest priority.”

Via Krebs on Security (opens in new tab)

Anthony Spadafora

After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.