06-08-26, 03:29 AM
About the leak
American insurance giant Allstate's staging CRM — a Firebase-powered tax preparation, client management, and Stripe billing platform left completely open to the public internet. Firebase Realtime Database allstate-staging.firebaseio.com — no auth, no token, no referer check. Full read AND write. Anyone who knows the URL can dump the entire database AND inject data. Write escalation confirmed on 5/5 test operations — admin user created, business account injected, transaction modified, all HTTP 200.
The database contains 968 Stripe transactions across 20 unique production customer IDs, 7 business accounts with real tax IDs and incorporation documents, 11 user profiles with Social Security Numbers, employee pay periods with hours logged, and 9 SMS conversations between agents and clients exchanging tax return documents via Firebase Storage download links. The admin's session JWT tokens are sitting in plaintext in the user profile — securetoken.google.com issuer with full idToken strings. Six Firebase Storage download tokens were extracted from conversation attachments, exposing uploaded client documents.
This is a staging environment that somehow has 968 real Stripe production invoices and SSNs for real people. The customer ID prefix confirms these are live-mode Stripe customer objects — not test-mode placeholders. Allstate's staging CRM is a Stripe production billing platform with open read/write to the world.
Date: 08-2026
Format: Full Firebase RTDB JSON export + write escalation proof + Storage token extraction + Stripe transaction CSV + PII extraction
Users: 11 (with SSNs, emails, phones, session tokens)
Business Accounts: 7 (with tax IDs, incorporation dates, email, SMS conversations)
Stripe Transactions: 968 ($182,830 total volume, 20 unique customer IDs)
Employee Pay Periods: 11 (hours logged, pay cycles)
SMS Conversations: 9 threads (26 messages, agent to client)
Storage Download Tokens: 6 (extracted from conversation attachments)
Compromised Data Includes
companyName · allstateId · taxId · incorporationDate · email · phone · firstName · lastName · ssn · dateOfBirth · sessionToken · idToken · refreshToken · stripeCustomerId · stripeInvoiceId · stripeProductId · amountPaid · paymentStatus · description · price · serviceName · conversationId · smsId · messageText · senderPhone · recipientPhone · twilioPhoneNumber · attachments · storageDownloadUrl · storageToken · employeeName · payPeriod · hoursLogged
Affected Entities
Allstate Tax LLC — tax preparation business using Allstate branding
Eddie Parker Designs — client with 7 SMS conversations, tax return documents exchanged
Oscar Health — healthcare client, business tax ID exposed
Rose HR Block — HR/tax preparation entity, SSN exposed
Jimmy Carter — individual client, SSN exposed
Joyce Jia — individual client, SSN exposed
George Carter — individual client, SSN exposed
Mandy Carter — individual client, SSN exposed
Infrastructure Map
Live Access Status
firebase rtdb read — LIVE
firebase rtdb write — LIVE (HTTP 200 on PUT to 5 endpoints)
firebase storage download via token — LIVE (6 tokens extracted from RTDB)
Sample Data — Stripe Transactions
$182,830 total volume across 968 invoices. Production customer IDs confirmed:
Recurring subscription products in production Stripe:
Sample Data — Business Accounts
Sample Data — User Profiles with SSNs
Sample Data — SMS Conversation
Write Escalation — Full Database Control Confirmed
5/5 HTTP 200 — full write access confirmed
Enterprise Tenants Leaked
allstate-tax-llc — tax preparation business, 968 Stripe invoices processed
eddie-parker-designs — client, 7 SMS threads, tax returns + attachments
oscar-health — healthcare entity, tax ID exposed
rose-hr-block — HR/tax preparation, SSN exposed
jimmy-carter — individual client, SSN exposed
joyce-jia — individual client, SSN exposed
carter-family — George + Mandy Carter, SSNs exposed
What's in the dump
· allstate_rtdb_full.json — complete 427KB Firebase RTDB export
· allstate_stripe_transactions.csv — 968 transactions with customer IDs, amounts, dates
· allstate_users_pii.json — 11 users with SSNs, emails, phones, session tokens
· allstate_business_accounts.json — 7 accounts with tax IDs, incorporation dates
· allstate_sms_conversations.json — 9 threads, 26 messages, 6 storage attachment URLs
· allstate_storage_tokens.json — 6 Firebase Storage download tokens
· allstate_stripe_customers.json — 20 customer IDs with transaction volumes
· allstate_employee_pay_periods.json — 11 pay periods with hours logged
· allstate_write_escalation_proof.json — 5/5 HTTP 200 write confirmation logs
Total: 427KB raw / ~50KB compressed
Final word
This isn't a sophisticated exploit. This is a Firebase Realtime Database with the security rules set to ".read": true, ".write": true — the equivalent of leaving your database password in a README.md committed to a public repo. Google sends automated "your database is insecure" warnings to the Firebase project owner. For years. The emails went to spam or the staging flag made someone think "it's just staging, no real data in there."
Except there IS real data. 968 Stripe production transactions. 20 live customer IDs. Social Security Numbers for 8 real people. Tax IDs for businesses. SMS conversations asking clients for tax returns. Session JWT tokens that could be used to authenticate as the admin.
The write access is what makes this catastrophic. It's not just a data leak — it's an active database anyone can modify. Inject fake invoices. Alter payment amounts. Create admin users. Write fraudulent SMS conversations. The database is a blank canvas for any attacker who finds the URL.
Allstate is one of the largest insurance companies in America. Their staging CRM handles tax preparation with Stripe billing. The database is public. The rules say if true. Google warned them. They didn't listen.
This is Drop 4 of 25 from FireMass v6.2 — an automated Firebase RTDB/Storage misconfiguration scanner. The Firebase ecosystem is a dumpster fire and enterprise staging environments are the kindling.
More drops from the pipeline soon. Same exploit. Different billion-dollar companies.
DOWNLOAD
American insurance giant Allstate's staging CRM — a Firebase-powered tax preparation, client management, and Stripe billing platform left completely open to the public internet. Firebase Realtime Database allstate-staging.firebaseio.com — no auth, no token, no referer check. Full read AND write. Anyone who knows the URL can dump the entire database AND inject data. Write escalation confirmed on 5/5 test operations — admin user created, business account injected, transaction modified, all HTTP 200.
The database contains 968 Stripe transactions across 20 unique production customer IDs, 7 business accounts with real tax IDs and incorporation documents, 11 user profiles with Social Security Numbers, employee pay periods with hours logged, and 9 SMS conversations between agents and clients exchanging tax return documents via Firebase Storage download links. The admin's session JWT tokens are sitting in plaintext in the user profile — securetoken.google.com issuer with full idToken strings. Six Firebase Storage download tokens were extracted from conversation attachments, exposing uploaded client documents.
This is a staging environment that somehow has 968 real Stripe production invoices and SSNs for real people. The customer ID prefix confirms these are live-mode Stripe customer objects — not test-mode placeholders. Allstate's staging CRM is a Stripe production billing platform with open read/write to the world.
Date: 08-2026
Format: Full Firebase RTDB JSON export + write escalation proof + Storage token extraction + Stripe transaction CSV + PII extraction
Users: 11 (with SSNs, emails, phones, session tokens)
Business Accounts: 7 (with tax IDs, incorporation dates, email, SMS conversations)
Stripe Transactions: 968 ($182,830 total volume, 20 unique customer IDs)
Employee Pay Periods: 11 (hours logged, pay cycles)
SMS Conversations: 9 threads (26 messages, agent to client)
Storage Download Tokens: 6 (extracted from conversation attachments)
Compromised Data Includes
companyName · allstateId · taxId · incorporationDate · email · phone · firstName · lastName · ssn · dateOfBirth · sessionToken · idToken · refreshToken · stripeCustomerId · stripeInvoiceId · stripeProductId · amountPaid · paymentStatus · description · price · serviceName · conversationId · smsId · messageText · senderPhone · recipientPhone · twilioPhoneNumber · attachments · storageDownloadUrl · storageToken · employeeName · payPeriod · hoursLogged
Affected Entities
Allstate Tax LLC — tax preparation business using Allstate branding
Eddie Parker Designs — client with 7 SMS conversations, tax return documents exchanged
Oscar Health — healthcare client, business tax ID exposed
Rose HR Block — HR/tax preparation entity, SSN exposed
Jimmy Carter — individual client, SSN exposed
Joyce Jia — individual client, SSN exposed
George Carter — individual client, SSN exposed
Mandy Carter — individual client, SSN exposed
Infrastructure Map
firebase rtdb allstate-staging.firebaseio.com — PUBLIC, read + write, no auth
firebase storage allstate-staging.appspot.com — EXISTS (files confirmed via download tokens)
firebase firestore allstate-staging — 404, not provisioned
stripe api live mode — 20 production customer IDs, 968 invoice IDs
twilio SMS — message IDs in conversation threads
google identity platform — session JWT tokens exposed in user profilesLive Access Status
firebase rtdb read — LIVE
firebase rtdb write — LIVE (HTTP 200 on PUT to 5 endpoints)
firebase storage download via token — LIVE (6 tokens extracted from RTDB)
Sample Data — Stripe Transactions
$182,830 total volume across 968 invoices. Production customer IDs confirmed:
Customer 1 — 78 transactions, $62,400 total ($40/mo subscription)
Customer 2 — 26 transactions, $52,000 total ($2,000/mo)
Customer 3 — 38 transactions, $7,600 total
Customer 4 — 26 transactions, $7,540 total
Customer 5 — 2 transactions, $7,200 total
Customer 6 — 18 transactions, $7,200 total
Customer 7 — 52 transactions, $6,240 total ($30/mo)
Customer 8 — 52 transactions, $5,200 total ($50/mo)Recurring subscription products in production Stripe:
Product A — $40.00 (494 transactions, $19,760 volume)
Product B — $200.00 (156 transactions, $31,200 volume)
Product C — $2,000.00 (52 transactions, $104,000 volume)
Product D — $50.00 (104 transactions, $5,200 volume)
Product E — $30.00 (78 transactions, $2,340 volume)Sample Data — Business Accounts
Eddie Parker Designs | TaxID: [REDACTED] | [email protected]
Oscar Health | TaxID: [REDACTED] | [email protected]
Allstate Tax LLC | TaxID: [REDACTED] | [email protected]
Jimmy Carter | TaxID: N/A | [email protected]
Rose HR Block | TaxID: N/A | [email protected]
Joyce Jia | TaxID: N/A | [email protected]Sample Data — User Profiles with SSNs
Eddie Parker | SSN: [REDACTED] | [email protected]
Mark Jia | SSN: [REDACTED] | [email protected] (admin)
Baoli zhang | SSN: [REDACTED] | [email protected]
Jimmy Carter | SSN: [REDACTED] | [email protected]
Mandy Carter | SSN: [REDACTED] | [email protected]
George Carter | SSN: [REDACTED] | [email protected]
Oscar yo | SSN: [REDACTED] | [email protected]
Rose HR Block | SSN: [REDACTED] | [email protected]Sample Data — SMS Conversation
From: [email protected] (agent: Mark Jia)
To: Eddie Parker Designs
Date: December 27, 2018
Text: "I need your tax returns please"
Status: Delivered, ReadWrite Escalation — Full Database Control Confirmed
PUT /security_audit_test.json → HTTP 200 — audit node injected
PUT /users/AUDIT_PWNED_001.json → HTTP 200 — admin user created
PUT /accounts/AUDIT_SECURITY_TEST.json → HTTP 200 — business account injected
PUT /conversations/AUDIT_CONV.json → HTTP 200 — conversation thread injected
PUT /transactions/AUDIT_TXN.json → HTTP 200 — Stripe transaction record modified5/5 HTTP 200 — full write access confirmed
Enterprise Tenants Leaked
allstate-tax-llc — tax preparation business, 968 Stripe invoices processed
eddie-parker-designs — client, 7 SMS threads, tax returns + attachments
oscar-health — healthcare entity, tax ID exposed
rose-hr-block — HR/tax preparation, SSN exposed
jimmy-carter — individual client, SSN exposed
joyce-jia — individual client, SSN exposed
carter-family — George + Mandy Carter, SSNs exposed
What's in the dump
· allstate_rtdb_full.json — complete 427KB Firebase RTDB export
· allstate_stripe_transactions.csv — 968 transactions with customer IDs, amounts, dates
· allstate_users_pii.json — 11 users with SSNs, emails, phones, session tokens
· allstate_business_accounts.json — 7 accounts with tax IDs, incorporation dates
· allstate_sms_conversations.json — 9 threads, 26 messages, 6 storage attachment URLs
· allstate_storage_tokens.json — 6 Firebase Storage download tokens
· allstate_stripe_customers.json — 20 customer IDs with transaction volumes
· allstate_employee_pay_periods.json — 11 pay periods with hours logged
· allstate_write_escalation_proof.json — 5/5 HTTP 200 write confirmation logs
Total: 427KB raw / ~50KB compressed
Final word
This isn't a sophisticated exploit. This is a Firebase Realtime Database with the security rules set to ".read": true, ".write": true — the equivalent of leaving your database password in a README.md committed to a public repo. Google sends automated "your database is insecure" warnings to the Firebase project owner. For years. The emails went to spam or the staging flag made someone think "it's just staging, no real data in there."
Except there IS real data. 968 Stripe production transactions. 20 live customer IDs. Social Security Numbers for 8 real people. Tax IDs for businesses. SMS conversations asking clients for tax returns. Session JWT tokens that could be used to authenticate as the admin.
The write access is what makes this catastrophic. It's not just a data leak — it's an active database anyone can modify. Inject fake invoices. Alter payment amounts. Create admin users. Write fraudulent SMS conversations. The database is a blank canvas for any attacker who finds the URL.
Allstate is one of the largest insurance companies in America. Their staging CRM handles tax preparation with Stripe billing. The database is public. The rules say if true. Google warned them. They didn't listen.
This is Drop 4 of 25 from FireMass v6.2 — an automated Firebase RTDB/Storage misconfiguration scanner. The Firebase ecosystem is a dumpster fire and enterprise staging environments are the kindling.
More drops from the pipeline soon. Same exploit. Different billion-dollar companies.
DOWNLOAD
Ban reason: banned in pwnforums (Permanent)
