Experian API Exposed Credit Scores of Most Americans
Summary: Independent researcher Bill Demirkapi found that a partner lender's website exposed an Experian API that returned FICO credit scores for tens of millions of Americans using only a name, mailing address, and all zeros in the date-of-birth field, with no authentication required. Experian said it confirmed a single instance, alerted the partner, and resolved the matter, but Demirkapi withheld the lender's identity because he suspects hundreds or thousands of companies use the same API and may leak it similarly.
What's compelling: A credit score and up to four risk factors could be pulled for any American whose name and address are already public, and Experian's fix addressed one endpoint rather than the systemic exposure Demirkapi warned about across potentially thousands of lending sites.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026