allstate.com — staging CRM Firebase 968 Stripe txns, $182K, full read/write 2026

chechnyafsbc · 06-08-26, 01:58 PM

niiiicccceeeeeeuuuuh Kisses

coffee123 · 06-08-26, 02:44 PM

Thanks for share!

osinting · 06-08-26, 03:54 PM

looks cool thanks for sharing

phoenix_leads · 06-08-26, 07:35 PM

Thanks Nice work.

r0x43g · 07-08-26, 01:07 AM

(06-08-26, 03:29 AM)exfilar Wrote:
About the leak

American insurance giant Allstate's staging CRM — a Firebase-powered tax preparation, client management, and Stripe billing platform left completely open to the public internet. Firebase Realtime Database allstate-staging.firebaseio.com — no auth, no token, no referer check. Full read AND write. Anyone who knows the URL can dump the entire database AND inject data. Write escalation confirmed on 5/5 test operations — admin user created, business account injected, transaction modified, all HTTP 200.

The database contains 968 Stripe transactions across 20 unique production customer IDs, 7 business accounts with real tax IDs and incorporation documents, 11 user profiles with Social Security Numbers, employee pay periods with hours logged, and 9 SMS conversations between agents and clients exchanging tax return documents via Firebase Storage download links. The admin's session JWT tokens are sitting in plaintext in the user profile — securetoken.google.com issuer with full idToken strings. Six Firebase Storage download tokens were extracted from conversation attachments, exposing uploaded client documents.

This is a staging environment that somehow has 968 real Stripe production invoices and SSNs for real people. The customer ID prefix confirms these are live-mode Stripe customer objects — not test-mode placeholders. Allstate's staging CRM is a Stripe production billing platform with open read/write to the world.

Date: 08-2026
Format: Full Firebase RTDB JSON export + write escalation proof + Storage token extraction + Stripe transaction CSV + PII extraction
Users: 11 (with SSNs, emails, phones, session tokens)
Business Accounts: 7 (with tax IDs, incorporation dates, email, SMS conversations)
Stripe Transactions: 968 ($182,830 total volume, 20 unique customer IDs)
Employee Pay Periods: 11 (hours logged, pay cycles)
SMS Conversations: 9 threads (26 messages, agent to client)
Storage Download Tokens: 6 (extracted from conversation attachments)

Compromised Data Includes

companyName · allstateId · taxId · incorporationDate · email · phone · firstName · lastName · ssn · dateOfBirth · sessionToken · idToken · refreshToken · stripeCustomerId · stripeInvoiceId · stripeProductId · amountPaid · paymentStatus · description · price · serviceName · conversationId · smsId · messageText · senderPhone · recipientPhone · twilioPhoneNumber · attachments · storageDownloadUrl · storageToken · employeeName · payPeriod · hoursLogged

Affected Entities

Allstate Tax LLC — tax preparation business using Allstate branding
Eddie Parker Designs — client with 7 SMS conversations, tax return documents exchanged
Oscar Health — healthcare client, business tax ID exposed
Rose HR Block — HR/tax preparation entity, SSN exposed
Jimmy Carter — individual client, SSN exposed
Joyce Jia — individual client, SSN exposed
George Carter — individual client, SSN exposed
Mandy Carter — individual client, SSN exposed

Infrastructure Map

firebase rtdb allstate-staging.firebaseio.com — PUBLIC, read + write, no auth firebase storage allstate-staging.appspot.com — EXISTS (files confirmed via download tokens) firebase firestore allstate-staging — 404, not provisioned stripe api live mode — 20 production customer IDs, 968 invoice IDs twilio SMS — message IDs in conversation threads google identity platform — session JWT tokens exposed in user profiles

Live Access Status

firebase rtdb read — LIVE
firebase rtdb write — LIVE (HTTP 200 on PUT to 5 endpoints)
firebase storage download via token — LIVE (6 tokens extracted from RTDB)

Sample Data — Stripe Transactions

$182,830 total volume across 968 invoices. Production customer IDs confirmed:

Customer 1 — 78 transactions, $62,400 total ($40/mo subscription) Customer 2 — 26 transactions, $52,000 total ($2,000/mo) Customer 3 — 38 transactions, $7,600 total Customer 4 — 26 transactions, $7,540 total Customer 5 — 2 transactions, $7,200 total Customer 6 — 18 transactions, $7,200 total Customer 7 — 52 transactions, $6,240 total ($30/mo) Customer 8 — 52 transactions, $5,200 total ($50/mo)

Recurring subscription products in production Stripe:

Product A — $40.00 (494 transactions, $19,760 volume) Product B — $200.00 (156 transactions, $31,200 volume) Product C — $2,000.00 (52 transactions, $104,000 volume) Product D — $50.00 (104 transactions, $5,200 volume) Product E — $30.00 (78 transactions, $2,340 volume)

Sample Data — Business Accounts

Eddie Parker Designs | TaxID: [REDACTED] | [email protected] Oscar Health | TaxID: [REDACTED] | [email protected] Allstate Tax LLC | TaxID: [REDACTED] | [email protected] Jimmy Carter | TaxID: N/A | [email protected] Rose HR Block | TaxID: N/A | [email protected] Joyce Jia | TaxID: N/A | [email protected]

Sample Data — User Profiles with SSNs

Eddie Parker | SSN: [REDACTED] | [email protected] Mark Jia | SSN: [REDACTED] | [email protected] (admin) Baoli zhang | SSN: [REDACTED] | [email protected] Jimmy Carter | SSN: [REDACTED] | [email protected] Mandy Carter | SSN: [REDACTED] | [email protected] George Carter | SSN: [REDACTED] | [email protected] Oscar yo | SSN: [REDACTED] | [email protected] Rose HR Block | SSN: [REDACTED] | [email protected]

Sample Data — SMS Conversation

From: [email protected] (agent: Mark Jia) To: Eddie Parker Designs Date: December 27, 2018 Text: "I need your tax returns please" Status: Delivered, Read

Write Escalation — Full Database Control Confirmed

PUT /security_audit_test.json → HTTP 200 — audit node injected PUT /users/AUDIT_PWNED_001.json → HTTP 200 — admin user created PUT /accounts/AUDIT_SECURITY_TEST.json → HTTP 200 — business account injected PUT /conversations/AUDIT_CONV.json → HTTP 200 — conversation thread injected PUT /transactions/AUDIT_TXN.json → HTTP 200 — Stripe transaction record modified

5/5 HTTP 200 — full write access confirmed

Enterprise Tenants Leaked

allstate-tax-llc — tax preparation business, 968 Stripe invoices processed
eddie-parker-designs — client, 7 SMS threads, tax returns + attachments
oscar-health — healthcare entity, tax ID exposed
rose-hr-block — HR/tax preparation, SSN exposed
jimmy-carter — individual client, SSN exposed
joyce-jia — individual client, SSN exposed
carter-family — George + Mandy Carter, SSNs exposed

What's in the dump

· allstate_rtdb_full.json — complete 427KB Firebase RTDB export
· allstate_stripe_transactions.csv — 968 transactions with customer IDs, amounts, dates
· allstate_users_pii.json — 11 users with SSNs, emails, phones, session tokens
· allstate_business_accounts.json — 7 accounts with tax IDs, incorporation dates
· allstate_sms_conversations.json — 9 threads, 26 messages, 6 storage attachment URLs
· allstate_storage_tokens.json — 6 Firebase Storage download tokens
· allstate_stripe_customers.json — 20 customer IDs with transaction volumes
· allstate_employee_pay_periods.json — 11 pay periods with hours logged
· allstate_write_escalation_proof.json — 5/5 HTTP 200 write confirmation logs

Total: 427KB raw / ~50KB compressed

Final word

This isn't a sophisticated exploit. This is a Firebase Realtime Database with the security rules set to ".read": true, ".write": true — the equivalent of leaving your database password in a README.md committed to a public repo. Google sends automated "your database is insecure" warnings to the Firebase project owner. For years. The emails went to spam or the staging flag made someone think "it's just staging, no real data in there."

Except there IS real data. 968 Stripe production transactions. 20 live customer IDs. Social Security Numbers for 8 real people. Tax IDs for businesses. SMS conversations asking clients for tax returns. Session JWT tokens that could be used to authenticate as the admin.

The write access is what makes this catastrophic. It's not just a data leak — it's an active database anyone can modify. Inject fake invoices. Alter payment amounts. Create admin users. Write fraudulent SMS conversations. The database is a blank canvas for any attacker who finds the URL.

Allstate is one of the largest insurance companies in America. Their staging CRM handles tax preparation with Stripe billing. The database is public. The rules say if true. Google warned them. They didn't listen.

This is Drop 4 of 25 from FireMass v6.2 — an automated Firebase RTDB/Storage misconfiguration scanner. The Firebase ecosystem is a dumpster fire and enterprise staging environments are the kindling.

More drops from the pipeline soon. Same exploit. Different billion-dollar companies.

DOWNLOAD

Gluttonbelly · 07-08-26, 06:40 PM

Great!

~~imreallytired~~ · 07-08-26, 07:31 PM

Thanks for sharing!

gh0st789 · 08-08-26, 08:50 PM

Thank you for sharing

julia89 · 10-08-26, 09:47 AM

(06-08-26, 03:29 AM)exfilar Wrote:
About the leak

American insurance giant Allstate's staging CRM — a Firebase-powered tax preparation, client management, and Stripe billing platform left completely open to the public internet. Firebase Realtime Database allstate-staging.firebaseio.com — no auth, no token, no referer check. Full read AND write. Anyone who knows the URL can dump the entire database AND inject data. Write escalation confirmed on 5/5 test operations — admin user created, business account injected, transaction modified, all HTTP 200.

The database contains 968 Stripe transactions across 20 unique production customer IDs, 7 business accounts with real tax IDs and incorporation documents, 11 user profiles with Social Security Numbers, employee pay periods with hours logged, and 9 SMS conversations between agents and clients exchanging tax return documents via Firebase Storage download links. The admin's session JWT tokens are sitting in plaintext in the user profile — securetoken.google.com issuer with full idToken strings. Six Firebase Storage download tokens were extracted from conversation attachments, exposing uploaded client documents.

This is a staging environment that somehow has 968 real Stripe production invoices and SSNs for real people. The customer ID prefix confirms these are live-mode Stripe customer objects — not test-mode placeholders. Allstate's staging CRM is a Stripe production billing platform with open read/write to the world.

Date: 08-2026
Format: Full Firebase RTDB JSON export + write escalation proof + Storage token extraction + Stripe transaction CSV + PII extraction
Users: 11 (with SSNs, emails, phones, session tokens)
Business Accounts: 7 (with tax IDs, incorporation dates, email, SMS conversations)
Stripe Transactions: 968 ($182,830 total volume, 20 unique customer IDs)
Employee Pay Periods: 11 (hours logged, pay cycles)
SMS Conversations: 9 threads (26 messages, agent to client)
Storage Download Tokens: 6 (extracted from conversation attachments)

Compromised Data Includes

companyName · allstateId · taxId · incorporationDate · email · phone · firstName · lastName · ssn · dateOfBirth · sessionToken · idToken · refreshToken · stripeCustomerId · stripeInvoiceId · stripeProductId · amountPaid · paymentStatus · description · price · serviceName · conversationId · smsId · messageText · senderPhone · recipientPhone · twilioPhoneNumber · attachments · storageDownloadUrl · storageToken · employeeName · payPeriod · hoursLogged

Affected Entities

Allstate Tax LLC — tax preparation business using Allstate branding
Eddie Parker Designs — client with 7 SMS conversations, tax return documents exchanged
Oscar Health — healthcare client, business tax ID exposed
Rose HR Block — HR/tax preparation entity, SSN exposed
Jimmy Carter — individual client, SSN exposed
Joyce Jia — individual client, SSN exposed
George Carter — individual client, SSN exposed
Mandy Carter — individual client, SSN exposed

Infrastructure Map

firebase rtdb allstate-staging.firebaseio.com — PUBLIC, read + write, no auth firebase storage allstate-staging.appspot.com — EXISTS (files confirmed via download tokens) firebase firestore allstate-staging — 404, not provisioned stripe api live mode — 20 production customer IDs, 968 invoice IDs twilio SMS — message IDs in conversation threads google identity platform — session JWT tokens exposed in user profiles

Live Access Status

firebase rtdb read — LIVE
firebase rtdb write — LIVE (HTTP 200 on PUT to 5 endpoints)
firebase storage download via token — LIVE (6 tokens extracted from RTDB)

Sample Data — Stripe Transactions

$182,830 total volume across 968 invoices. Production customer IDs confirmed:

Customer 1 — 78 transactions, $62,400 total ($40/mo subscription) Customer 2 — 26 transactions, $52,000 total ($2,000/mo) Customer 3 — 38 transactions, $7,600 total Customer 4 — 26 transactions, $7,540 total Customer 5 — 2 transactions, $7,200 total Customer 6 — 18 transactions, $7,200 total Customer 7 — 52 transactions, $6,240 total ($30/mo) Customer 8 — 52 transactions, $5,200 total ($50/mo)

Recurring subscription products in production Stripe:

Product A — $40.00 (494 transactions, $19,760 volume) Product B — $200.00 (156 transactions, $31,200 volume) Product C — $2,000.00 (52 transactions, $104,000 volume) Product D — $50.00 (104 transactions, $5,200 volume) Product E — $30.00 (78 transactions, $2,340 volume)

Sample Data — Business Accounts

Eddie Parker Designs | TaxID: [REDACTED] | [email protected] Oscar Health | TaxID: [REDACTED] | [email protected] Allstate Tax LLC | TaxID: [REDACTED] | [email protected] Jimmy Carter | TaxID: N/A | [email protected] Rose HR Block | TaxID: N/A | [email protected] Joyce Jia | TaxID: N/A | [email protected]

Sample Data — User Profiles with SSNs

Eddie Parker | SSN: [REDACTED] | [email protected] Mark Jia | SSN: [REDACTED] | [email protected] (admin) Baoli zhang | SSN: [REDACTED] | [email protected] Jimmy Carter | SSN: [REDACTED] | [email protected] Mandy Carter | SSN: [REDACTED] | [email protected] George Carter | SSN: [REDACTED] | [email protected] Oscar yo | SSN: [REDACTED] | [email protected] Rose HR Block | SSN: [REDACTED] | [email protected]

Sample Data — SMS Conversation

From: [email protected] (agent: Mark Jia) To: Eddie Parker Designs Date: December 27, 2018 Text: "I need your tax returns please" Status: Delivered, Read

Write Escalation — Full Database Control Confirmed

PUT /security_audit_test.json → HTTP 200 — audit node injected PUT /users/AUDIT_PWNED_001.json → HTTP 200 — admin user created PUT /accounts/AUDIT_SECURITY_TEST.json → HTTP 200 — business account injected PUT /conversations/AUDIT_CONV.json → HTTP 200 — conversation thread injected PUT /transactions/AUDIT_TXN.json → HTTP 200 — Stripe transaction record modified

5/5 HTTP 200 — full write access confirmed

Enterprise Tenants Leaked

allstate-tax-llc — tax preparation business, 968 Stripe invoices processed
eddie-parker-designs — client, 7 SMS threads, tax returns + attachments
oscar-health — healthcare entity, tax ID exposed
rose-hr-block — HR/tax preparation, SSN exposed
jimmy-carter — individual client, SSN exposed
joyce-jia — individual client, SSN exposed
carter-family — George + Mandy Carter, SSNs exposed

What's in the dump

· allstate_rtdb_full.json — complete 427KB Firebase RTDB export
· allstate_stripe_transactions.csv — 968 transactions with customer IDs, amounts, dates
· allstate_users_pii.json — 11 users with SSNs, emails, phones, session tokens
· allstate_business_accounts.json — 7 accounts with tax IDs, incorporation dates
· allstate_sms_conversations.json — 9 threads, 26 messages, 6 storage attachment URLs
· allstate_storage_tokens.json — 6 Firebase Storage download tokens
· allstate_stripe_customers.json — 20 customer IDs with transaction volumes
· allstate_employee_pay_periods.json — 11 pay periods with hours logged
· allstate_write_escalation_proof.json — 5/5 HTTP 200 write confirmation logs

Total: 427KB raw / ~50KB compressed

Final word

This isn't a sophisticated exploit. This is a Firebase Realtime Database with the security rules set to ".read": true, ".write": true — the equivalent of leaving your database password in a README.md committed to a public repo. Google sends automated "your database is insecure" warnings to the Firebase project owner. For years. The emails went to spam or the staging flag made someone think "it's just staging, no real data in there."

Except there IS real data. 968 Stripe production transactions. 20 live customer IDs. Social Security Numbers for 8 real people. Tax IDs for businesses. SMS conversations asking clients for tax returns. Session JWT tokens that could be used to authenticate as the admin.

The write access is what makes this catastrophic. It's not just a data leak — it's an active database anyone can modify. Inject fake invoices. Alter payment amounts. Create admin users. Write fraudulent SMS conversations. The database is a blank canvas for any attacker who finds the URL.

Allstate is one of the largest insurance companies in America. Their staging CRM handles tax preparation with Stripe billing. The database is public. The rules say if true. Google warned them. They didn't listen.

This is Drop 4 of 25 from FireMass v6.2 — an automated Firebase RTDB/Storage misconfiguration scanner. The Firebase ecosystem is a dumpster fire and enterprise staging environments are the kindling.

More drops from the pipeline soon. Same exploit. Different billion-dollar companies.

DOWNLOAD

thank you bro

Molecula_88 · 10-08-26, 04:54 PM

thanks dude