The database contained the names, addresses and extremely detailed case notes, exposing the plaintiffs and defendants and their cases. The records were categorized by abbreviated names and I can assume that they were as follows: IMM (Immigration); FAM (Family); and CRI (Criminal). These records could have possibly been edited, altered, or even deleted due to the misconfiguration and lack of administrative credentials, say the researchers.

Image courtesy of WebsitePlanet

The researchers immediately contacted the Cook County CTO. The database was secured days later. It is unclear, however, if the affected individuals were notified about the data exposure or if they were were informed about the risk of how this information could be used to potentially target them. The researchers say, "We could not find any reference to a public notice of a data breach of court records. No one replied to our responsible disclosure notice, phone voice message, or a follow up email, so we were unable to know exactly what these records were used for or the full extent of the exposure."

The data, if accessed by malicious actors, could be highly valuable, as the database was not password-protected and lacked basic security protections, the research team notes. Individuals could be targeted for their personal data, and potentially blackmailed, harassed and threatened to have their records exposed. 

For the full report and findings, please visit https://www.websiteplanet.com/blog/court-records-leak-report/