Database used by world's banks, spy agencies leaked

A confidential database used by the world’s largest banks to help them judge who to take on as clients was leaked online, the company’s operator has confirmed.

Chris Vickery, an internet security researcher, had posted a Reddit message on Tuesday saying that he had been able to access a mid-2014 version of World-Check, the database run by financial information giant Thomson Reuters.

He said the copy of the database, also used by intelligence agencies and law firms, has more than 2.2 million records about individuals and organisations, under categories ranging from terrorism to corruption to organised crime.

Vickery did not disclose how he obtained the copy. 

By late Wednesday, Thomson Reuters released a statement saying that a third party had taken down the leaked database and had ensured with the party "there will be no repetition of this unacceptable incident".

The database raised controversy last year when Middle East Eye contributor Peter Oborne and BBC journalist Anne Meisel first revealed that the HSBC bank accounts of several Muslim institutions and individuals, including the chairman of the Finsbury Park Mosque, were closed after they were listed under the terrorism category on the database. 

Journalists cannot get access to World-Check, but a client gave Oborne and Meisel access for 30 minutes during which time they were able to confirm how the groups and individuals had been labelled.

World-Check stresses on its website that “accuracy of the information found in the underlying media sources should be verified with the profile subject before any action is taken” and that the decision to open or close accounts lay with the banks.

While profiles on the database are created from publicly available information that anyone can access, questions remain about whether banks and others can always reach an informed decision about clients based on World-Check's information.

In his post on Reddit, Vickery said he is considering whether he should leak the database and was soliciting opinions from readers.

“At the very least, this should jump-start a little online conversation regarding the appropriateness of having private entities maintain lists utilised by government agencies and banks,” he wrote.

In comments he added later to his post after he said he had talked with Thomson Reuters, Vickery noted that the company is not the only one gathering the kind of data stored in World-Check. "They may be a leader in the industry, but it's not fair to vilify them as if they were the only company in the market," he said.

Thomson Reuters said earlier on Wednesday that it was grateful to Vickery for alerting them to the leaked information.