Research from Cybersecurity Researcher Jeremiah Fowler has uncovered an unencrypted, non-password-protected database containing 245,949 records. 

The database appears to belong to Rockerbox, a tax credit consultancy. The files hosted personally identifiable information (PII) that, if in the possession of a malicious actor, could leave individuals at risk of phishing, social engineering, financial crimes or identity theft. However, at this time, there is no evidence that any threat actor accessed this data. 

The PII included in the database includes: 

• Names 
• Addresses 
• Email addresses 
• Birth dates 
• Social Security numbers and/or Social Security number cards 
• Driver’s licenses
• Identification cards 
• Work opportunity tax credit documents (including employment and salary information) 
• Letters of acceptance or denial of eligibility 
• DD214 forms (Certificates of Release or Discharge from Active Duty) 

Fowler sent a responsible disclosure notice to the organization, and the database was later restricted.