Florida-based TCM Bank N.A., a company that primarily offers credit card services to credit unions and other small financial institutions, has been found to be exposing the personal data of credit card applicants for over a year.

The breach was reported Friday by security researcher Brian Krebs. The company said it was caused by a website misconfiguration and that “fewer than 10,000 consumers who applied for cards were affected.” TCM also noted that was less than 25 percent of the applications processed during that time and less than 1 percent of the cardholder base was affected.

On its website, TCM claims to work with 750 financial institutions across the U.S. and serves more than 300,000 customers.

Jessica Marie, cybersecurity evangelist at WhiteHat Security Inc., told SiliconANGLE that vulnerabilities and misconfigurations in websites are incredibly common, even among highly regulated financial services companies.

“Many businesses, across all industries, are still unaware of online business risks or have delayed taking appropriate action,” she said. “This is unfortunate for them and their users since websites typically house sensitive customer data.”

As a network of community banks, TCM Bank handles documents filled with personally identifiable information including credit card applications, Marie explained. “Unfortunately in this instance, misconfiguration, which is one of the most critical application security risks, caused a significant leak of customer information,” she said. “Organizations that rely on digital platforms should also empower developers to code using security best practices throughout the entire software development life cycle, with proper training and security certifications.”

Photo: Nick Youngson/Alpha Stock Images