Major Data Breach at Check24 & Verivox: What It Means for Consumer Privacy and Insurance
When you use an online comparison portal to shop for insurance quotes, loan rates, or credit cards, you trust them with your most sensitive personal and financial data. A recent investigative report by Correctiv, supported by the Chaos Computer Club (CCC), reveals that this trust may have been severely misplaced at two of Germany's largest platforms: Check24 and Verivox. The report alleges "grave data leaks" that exposed detailed customer information, potentially affecting millions. While both companies confirm a vulnerability existed and claim to have fixed it, the incident raises critical questions about data security, consumer protection, and the safety of sharing information online. This analysis breaks down what happened, the implications for anyone who has compared financial products, and essential steps to safeguard your data.
The Breach: How Sensitive Data Was Left Exposed
The vulnerability was discovered by an anonymous IT expert from the Chaos Computer Club, a renowned European hacker association focused on digital rights and security. The flaws were not hidden deep within complex systems; the researcher reportedly "stumbled over" them. The exposure primarily affected the loan comparison sections of both platforms.
The Simple Yet Critical Flaws
The security lapses were shockingly basic, described by the CCC as "beginner mistakes that shouldn't happen."
- Predictable URLs & Universal Passwords: When users compared loans as a "guest," they received a personalized offer via a unique web link (URL). At Check24, this link was protected by a password—but it was the same password for all customers and transmitted automatically by the browser. The URL ended with a sequential number. By simply incrementing or decrementing this number, anyone could access and download the loan offers (as PDFs) of other customers without any login.
- No Password at Verivox: At Verivox, the same method worked without any password protection at all.
- WebSocket Exploit at Check24: A second, more technical flaw at Check24 involved a "WebSocket" connection—a technology for real-time data exchange. Using a simple program, an attacker could exploit this connection to retrieve pre-filled loan application data sent by banks, accessing an even richer trove of information.
The CCC likened the flaw to an apartment building where all basement storage units have padlocks, but the universal code to open them is posted visibly at the entrance.
The Data at Risk: A Treasure Trove for Fraudsters
The exposed documents were not mere quotes. They contained comprehensive dossiers suitable for identity theft and financial fraud. According to the report, the accessible data included:
- Full Personal Identification: Name, address, date of birth.
- Detailed Financial Profile: Net household income, employment status, existing loans, rental status, requested loan amount, monthly payments, and even bank account IBAN numbers.
- Private Life Details: Number of children, number of vehicles owned, length of residence.
"It was a worst-case scenario," stated CCC spokesperson Matthias Marx. "Anyone could see where users live, how many children they have, where they work, what they earn, and how much money they are currently spending on loans."
Company Responses and Ongoing Investigations
Both Check24 and Verivox confirmed the vulnerability to Correctiv and stated they had closed the security gaps promptly after being notified in August. They maintain that, according to their log file analyses, there is no evidence the data was actually accessed or misused by malicious actors beyond the white-hat hacker who reported it.
However, a Check24 spokesperson contested the media portrayal, telling Versicherungsbote: "The press makes it look as if we really lost data. There is no indication for this hypothesis... We assume, based on log analysis, that we have not lost any customer data."
Despite these assurances, the relevant data protection authorities have launched investigations. The companies must now prove through forensic log analysis that no unauthorized access occurred—a challenging task, especially if the vulnerability existed undetected for months, as Correctiv suggests.
Implications for Insurance Consumers and Professionals
This incident is a stark reminder for everyone involved in financial services:
- For Consumers: Be extremely cautious about where and how you submit your personal data. Understand that comparison portals are data aggregators and their security practices vary widely.
- For Insurance Agents & Brokers: This highlights a key value proposition of personalized, advisor-mediated service. When clients work directly with you, their sensitive data isn't being fed into a potentially vulnerable digital comparison engine. Emphasize your commitment to client confidentiality and secure data handling as a competitive advantage.
- For the Industry: It underscores the non-negotiable need for robust cybersecurity insurance and data breach response plans for any company handling personal data.
How to Protect Yourself After Using Comparison Sites
If you have used Check24, Verivox, or similar platforms for insurance or loan comparisons, consider these steps:
- Monitor Your Accounts: Closely review bank and credit card statements for any unauthorized transactions.
- Consider a Credit Freeze: Place a fraud alert or security freeze on your credit reports with the major bureaus to prevent new accounts from being opened in your name.
- Change Passwords: If you used the same password on these sites elsewhere, change it immediately on all other accounts, especially email and financial services.
- Be Wary of Phishing: Expect an increase in sophisticated phishing emails or calls referencing your loan or insurance inquiries. Never click on links or provide information to unsolicited contacts.
- Ask Your Advisor: If you work with an insurance agent or financial planner, discuss this incident with them. They can provide guidance and review your existing policies for identity theft protection coverage.
The Check24 and Verivox incident serves as a powerful wake-up call. In the digital age, data privacy is paramount. Whether you're a consumer seeking the best rate or a professional entrusted with client information, vigilance and a commitment to security are your best defenses.