iFacts Exposes 21,000 Sensitive Files of South African Citizens

This report discloses a significant security misconfiguration involving a publicly exposed server containing data from South African company iFacts (Pty) Ltd. The server held approximately 11.83 GB of highly sensitive personal data belonging to South African citizens, including identity documents, resumes, certificates and risk reports (around 21,000 files). Following responsible disclosure efforts, the server was eventually taken offline. However, no response or acknowledgment was received from iFacts.

The exposed server was identified during routine security research using publicly available tools designed to locate misconfigured servers and open directories on the internet. No unauthorized access or exploitation techniques were used. Once the presence of sensitive personal data was confirmed, the scope of the investigation was limited to assessing the nature and extent of the exposure.

This server contained 11.83 GB of information on individuals evaluated by iFacts for potential employment at other companies. Upon verification, it was confirmed that it contained approximately 21,000 exposed files.

According to my investigation, this server has been exposed since 1 April 2026 , which exposed the following files:

All documents were in PDF and PNG formats.

The first documents we found were named “ Risk-Report ”, with the main heading stating “ Private & Confidential ”. These documents exposed candidate data, such as names , date of birth , and gender ; only the ID/passport number was redacted . In another folder, named “ report/pdf ”, the final reports for the candidates were located, along with the name of the client who requested iFacts services. Below is an example of the complete iFacts report.

Another document in a folder called “ Documents ” was titled “ Consents for the Use of Personal Information (Applicants) ” Some of these documents contained ID cards , diplomas , certificates , attached resumes , and personal data such as full name , ID number , contact number , alternative number , email address , physical address , postal code , population group , gender , whether the candidate had ever been convicted of an offense , and the candidate’s signature . You can see an example below.

The public exposure of this highly sensitive dataset posed severe and multi-layered risks to the affected South African citizens:

No response was ever received from iFacts despite multiple attempts. Subsequent checks confirmed that the IP address and all associated routes now have improved protection.

This report will be updated if additional information or responses are received from the responsible authorities.

This research was conducted solely for the purpose of improving security. No unnecessary data was downloaded or retained, and all findings were responsibly disclosed in accordance with standard responsible disclosure practices.

Report published: July 29, 2026 Security Researcher: chum1ng0 data breach misconfigurations ZA Newer iFacts Exposes 21,000 Sensitive Files of South African Citizens

Exclusive reports about data breach research (responsible disclosures) by chum1ng0