Rockerbox Data Security Investigation

Recently, it was reported by an online source that Rockerbox had experienced a cybersecurity incident impacting the privacy of its data. According to this source, a cybersecurity researcher discovered an unencrypted and non-password-protected database that contained thousands of records belonging to Rockerbox.¹ The exposed database contained 245,949 records with a total size of 286.9 GB.¹ In a limited sampling of the exposed documents, the researcher saw files that detailed personal identifiable information such as names, physical addresses, email addresses, date of birth, and Social Security numbers in plain text. There were also driver’s licenses, identification cards, SSN cards, work opportunity tax credit documents that included employment and salary information, and determination letters with acceptance or denials of eligibility.¹

According to the source, after discovering the database, the researcher notified Rockerbox of the exposure. Rockerbox did not issue a reply but several days later public access to the documents was restricted.¹ At this time, it is not known how long these documents were exposed to the public or if anyone else may have accessed the database.¹ As of July 8, 2025, Rockerbox has not publicly acknowledged the data exposure or confirmed whether the incident resulted in a data breach.