Fintech Giant Fiserv Used Unclaimed Domain
Summary: Security researcher Abraham Vegh registered the unregistered domain defaultinstitution.com in November 2020 after noticing his bank's email referenced it, then set up a catch-all inbox that collected misdirected messages from Fiserv software used by banks. Fiserv acknowledged that auto-generated emails to customers at 5 clients carried the placeholder domain in the reply-to address, and the last such email arrived on Feb. 26.
Why it matters: The intercepted messages included CashEdge/Popmoney transfer details - plan ID, send date, amount, and the name and last four digits of the source account - plus Netspend one-time confirmation codes, all landing in a stranger's inbox because a placeholder was never replaced.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026