Unsecured database exposed over a million NorthOne-branded invoices

Security researcher Jeremiah Fowler reported in April 2023 that he had found a database with no password protection holding more than one million PDF invoices carrying NorthOne branding. NorthOne is a business banking financial technology company with offices in New York and Toronto that says it serves over 320,000 American businesses.

The invoices had been generated by individuals and small businesses billing for services such as home repairs, pet care, food and beverage work and medical care. Fowler said the documents contained names, email and physical addresses, phone numbers, a note describing what the payment covered, the total amount and the due date. Some carried tax identification numbers, including employer identification numbers. In a random sample of 1,000 invoices the amounts ranged from about $60 to more than $10,000. The database was marked as production.

Fowler said he sent a responsible disclosure notice on January 19, 2023 and that the database remained reachable until January 31, after several follow-up messages. NorthOne told him it had investigated, resolved the issue and had no outstanding problems.

NorthOne disputed the framing. Chief executive Eytan Bensoussan told American Banker that no breach or leak occurred and that no data was compromised or made public. He described the source as a free PDF invoice generator that was a separate entity from NorthOne's banking product and had roughly 20,000 users at its peak, and said the service was terminated after the exposure surfaced. The figure of one million therefore refers to documents, not to NorthOne banking customers.