Loading story…
Rainwalk Pet Insurance, a company based in South Carolina, suffered a significant data exposure incident after a misconfigured and unsecured database was discovered online. The database, which was not protected by a password or encryption, contained approximately 158 GB of sensitive data, including over 85,000 files. The exposed information included customers' names, phone numbers, physical and email addresses, and partial credit card numbers. In addition to customer data, the database also contained detailed information about their pets, such as names, breeds, microchip numbers, and medical histories. The breach was discovered by cybersecurity researcher Jeremiah Fowler, who reported the issue to Website Planet for verification. Fowler notified Rainwalk of the exposure, but the company reportedly took almost a month to secure the database after being alerted. The delay in response increased the risk that malicious actors could have accessed the data during the exposure window. The leaked data poses significant privacy and financial threats to affected customers, as threat actors could potentially use the information to make fraudulent insurance claims, conduct scams related to pet microchip expiration, or create fake invoices. There is also a risk that attackers could intercept refunds or payments intended for customers, especially through platforms like Venmo. The incident highlights the lack of specific privacy regulations for pet data, which, when combined with personal identifying information, becomes a lucrative target for cybercriminals. Screenshots of the exposed data, including claim approvals and veterinary invoices, were shared by the researcher to demonstrate the severity of the leak. The breach underscores the need for pet insurance companies to implement stronger encryption and access controls to protect sensitive customer and pet information. The full extent of the exposure remains unclear, as it is not known how long the database was accessible or whether unauthorized parties accessed the data. The incident serves as a warning to other organizations handling similar data to prioritize security and respond promptly to vulnerability disclosures. Rainwalk's delayed response to the notification has drawn criticism from cybersecurity experts. The exposure of both financial and personal data increases the risk of identity theft and financial fraud for affected customers. The case also raises questions about industry standards for data protection in the pet insurance sector. Overall, the incident demonstrates the critical importance of securing databases and responding swiftly to security reports to mitigate potential harm.
See attribution, scope, and your downstream exposure.
1 event from the most recent confirmed update back to the earliest known activity.
A misconfiguration exposed approximately 158 GB of data belonging to Rainwalk Pet Insurance, affecting U.S. customer and pet information. The available references describe the incident as an inadvertent leak rather than a malicious breach.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Healthcare Interactive, a company specializing in AI-driven medical insurance benefit enrollment and billing solutions, confirmed a significant data breach that resulted in the exfiltration of sensitive customer data by hackers. The compromised information included names, dates of birth, Social Security numbers, contact details, health insurance enrollment data, patient diagnoses, provider names, lab results, medical images, and treatment plans. The breach also involved medical claims data, such as account numbers and billing codes. The incident occurred between July 8 and July 12, 2025, but was only detected around July 22, prompting the company to notify regulators and launch an internal investigation. The method of intrusion was not disclosed, leaving uncertainty about whether social engineering or phishing was involved. In a separate but related trend, Allianz Life, a major American insurance provider, reported a data breach in July 2025 that affected nearly 1.5 million individuals, including customers, financial professionals, and employees. The breach was traced to unauthorized access of a third-party cloud-based CRM system, with the ShinyHunters extortion group suspected to be behind the attack. Exposed data included names, addresses, dates of birth, and Social Security numbers, though earlier reports suggested additional information such as email addresses and phone numbers may have been compromised. Allianz Life has since notified affected individuals and authorities, and provided instructions for protective measures. Another incident involved ClaimPix, an Illinois-based auto insurance claims platform, where a misconfigured and unencrypted database exposed over 5.1 million files, totaling 10.7 terabytes of data. The exposed records included personal identifiable information, insurance documents, vehicle registrations, repair invoices, and images of damaged vehicles, as well as sensitive Power of Attorney documents that could facilitate fraud or impersonation. Archer Health, a U.S. provider of palliative and in-home care services, also suffered a data exposure due to a misconfigured database, leaking nearly 145,000 health records containing names, Social Security numbers, diagnostic details, and treatment plans. The company responded by securing the database and initiating an investigation, though it remains unclear if the data was accessed by malicious actors. These incidents collectively highlight a pattern of significant data breaches affecting the insurance and healthcare sectors, often involving misconfigured cloud storage or third-party service vulnerabilities. The breaches have exposed millions of individuals' sensitive personal and health information, raising concerns about the adequacy of cybersecurity measures in these industries. Regulatory notifications and investigations have been initiated in each case, but the full impact on affected individuals and organizations is still being assessed. The incidents underscore the critical need for robust data protection, regular security audits, and stringent oversight of third-party service providers. The exposure of highly sensitive data, including medical diagnoses and legal documents, increases the risk of identity theft, fraud, and other malicious activities. Organizations are urged to review their cloud security configurations and incident response protocols to prevent similar breaches. The healthcare and insurance sectors remain prime targets for cybercriminals due to the value of the data they hold. These breaches serve as a stark reminder of the evolving threat landscape and the importance of proactive cybersecurity strategies.
Jun 29, 2026
Cybersecurity researcher Jeremiah Fowler discovered a publicly accessible database containing 178,519 files linked to the cloud-based invoicing platform Invoicely. The exposed database included a wide array of sensitive documents, such as invoices, scanned checks, tax forms, banking information in both PDF and CSV formats, and other financial records. Personally identifiable information (PII) was also present, including names, tax identification numbers, phone numbers, and physical addresses of clients, partners, and employees from around the world. Additional sensitive documents found in the database included medical payment receipts and airline tickets, further increasing the risk of identity theft and privacy violations. The database was not protected by a password or encryption, making it easily accessible to anyone who discovered its location online. The exposure of such data presents significant risks for financial fraud, particularly invoice fraud, as cybercriminals could use the information to create convincing fake invoices or target individuals and businesses for spear-phishing attacks. The presence of detailed financial and personal data could also facilitate broader identity theft schemes. Invoicely, operated by Vienna-based Stack Holdings GmbH, is a widely used platform, reportedly serving over 250,000 businesses globally, amplifying the potential impact of the breach. It remains unclear whether the exposed database was directly managed by Invoicely or by a third-party contractor, and there is no public information on how long the data was accessible or whether it was accessed by malicious actors. After Fowler reported the issue, the database was promptly taken offline to prevent further exposure. The incident highlights the critical importance of encrypting sensitive data and implementing robust access controls, as even a single misconfiguration can lead to massive data leaks. Fowler emphasized that proper encryption would have made the data extremely difficult to access without the correct credentials, even if the database was exposed. The event serves as a stark reminder for SaaS providers and their clients to regularly audit their data storage practices and ensure compliance with data protection standards. The lack of immediate clarity regarding the management and duration of the exposure raises concerns about potential regulatory and reputational consequences for Invoicely. Organizations using cloud-based financial platforms are urged to review their own security postures in light of this incident.
Jun 29, 2026
A misconfigured Elasticsearch server, believed to be operated from Russia or a Russian-speaking country, was discovered leaking over 6.19 billion records to the public internet without any authentication or password protection. The exposed server contained a massive trove of 1.12 terabytes of data, including records collected from both disclosed and undisclosed data breaches, as well as information obtained through website scraping. Among the most sensitive data found were records from Ukrainian bank Accordbank, which included users’ full names, birthdates, birthplaces, addresses, phone numbers, national ID numbers, passport numbers, and tax codes. Independent cybersecurity researcher Anurag Sen was the first to identify the exposed server and report its existence to the media. The server’s index information confirmed the scale of the exposure, with over 6.19 billion records available for anyone to access. Screenshots from the server revealed that the data was stored in JSON format and included detailed personally identifiable information (PII) from various sources. The database also contained files referencing Accordbank, which were later observed being peddled by the user "tRex_Prime" on DarkForums, indicating that the data may have already been accessed and distributed by other threat actors. The leak included not only banking and contact information but also records from other breaches and data scraped from websites, making the exposure particularly broad and damaging. The server was eventually taken offline, but it remains unclear how long the data was accessible or how many unauthorized parties may have downloaded the information. Previous incidents involving hacking groups such as ShinyHunters and Nemesis were also mentioned, as they had leaked stolen data and hacking tools from other exposed cloud storage resources in the past. The incident highlights the ongoing risks associated with misconfigured cloud infrastructure and the potential for large-scale data aggregation to amplify the impact of breaches. Security experts warn that such exposed databases are prime targets for cybercriminals seeking to exploit PII for identity theft, fraud, and further attacks. The presence of both old and new breach data, as well as scraped information, demonstrates the evolving tactics of threat actors in collecting and monetizing sensitive information. Organizations are urged to regularly audit their cloud configurations and monitor for unauthorized data exposures to prevent similar incidents. The scale and sensitivity of the leaked data underscore the urgent need for improved security practices in managing large datasets, especially those containing PII from multiple sources. The incident serves as a stark reminder of the consequences of failing to secure cloud-based data storage and the far-reaching impact such exposures can have on individuals and organizations worldwide.
Jul 12, 2026