DATABASE BridgeStorage - Leaked, Download

(06-25-2026, 09:25 PM)NightBroker Wrote: Hello SpearForums, today I have the databases for BridgeStorage (www.bridgestorage.com), a self-storage and creative space rental company.

In June 2026, the American self-storage and creative space rental company was breached by @NightBroker and shared to SpearForums.

The leak may be a sub-company of https://bridge.ai as the administrator email for the company is "admin@bridge.ai", that along with other hints in the admin panel itself. I didn't include that in the title though in-case this isn't true.

After initial access to the admin panel was gained, there wasn't much data that could be scraped from it. However, an exploit was found in their Django API implementation that allowed for a lot of data to be scraped. This was hosted on their railway.app project and allowed for all the data to be scraped without any rate-limiting, and in some cases without any authentication (such as in the case of the users/customers). All-in-all, really bad security by a seemingly vibe-coded website which could be seen from suspicious source-code with a lot of comments and code practices similar to that of an AI.

In the leak, all the files under the "access" directory seems to be physical access data for the tenants in property units that the company leases to their customers.

This leak contains 21 JSON files:

• access/access-points.json - 9 records
  
• access/customer-access-grant-list.json - 12 records
  
• applications/rental-applications.json - 92 records
  
• billing/invoice-line-items.json - 159,481 records
  
• billing/invoices.json - 50,646 records
  
• bookings/bookings.json - 195 records
  
• contracts/contracts.json - 599 records
  
• contracts/rate-changes.json - 488 records
  
• customers/customers.json - 5284 records
  
• customers/notes.json - 10,802 records
  
• insurance/insurance-plans.json - 3 records
  
• insurance/insurance-policies.json - 1 records
  
• liens/contract-lien-state-list.json - 575 records
  
• liens/jurisdictions.json - 1 records
  
• payments/autopay-history.json - 67 records
  
• payments/payment-history.json - 36,735 records
  
• reservations/reservations.json - 1 records
  
• reservations/waitlist.json - 1 records
  
• scheduling/public-events.json - 188 records
  
• scheduling/resources.json - 8 records
  
• units/units.json - 774 records
  

The compromised data in customers.json consists of:

Code:

id, full_name, first_name, last_name, company_name, email, phone, alt_phone, preferred_contact_method, address_line1, address_line2, city, state, postal_code, country, emergency_contact_name, emergency_contact_phone, alternate_contact_name, alternate_contact_phone, alternate_address_line1, alternate_address_line2, alternate_city, alternate_state, alternate_postal_code, drivers_license_number, drivers_license_state, employer_name, employer_phone, intended_uses, security_question, security_answer, access_code, gate_code, brevo_contact_id, notes, vetting_tier, vetting_status, vetting_flags, vetting_notes, vetting_questionnaire, approved_by, approved_at, stripe_customer_id, autopay_enabled, autopay_payment_method_id, autopay_last_four, autopay_bank_name, autopay_enrolled_at, autopay_method_type, autopay_approved_by, autopay_approval_date, autopay_approval_reason, credit_balance, customer_type, is_billable, photo_url, marketing_tags, base_user, note_entries, created_at, updated_at

Sample

Code:

{"id":"cdd8de24-e710-4a6f-ab95-826a975e5514","full_name":"ZORAIR ROUBINIAN","first_name":"ZORAIR","last_name":"ROUBINIAN","company_name":"","email":"ess-no-email-853b1165b912bccb734c@example.invalid","phone":"(415) 713-5007","alt_phone":"","preferred_contact_method":"email","address_line1":"","address_line2":"","city":"","state":"","postal_code":"","country":"","emergency_contact_name":"","emergency_contact_phone":"","alternate_contact_name":"","alternate_contact_phone":"","alternate_address_line1":"","alternate_address_line2":"","alternate_city":"","alternate_state":"","alternate_postal_code":"","drivers_license_number":"","drivers_license_state":"","employer_name":"","employer_phone":"","intended_uses":[],"security_question":"","security_answer":"","access_code":"","gate_code":null,"brevo_contact_id":"","notes":"","vetting_tier":"T0","vetting_status":"pending","vetting_flags":[],"vetting_notes":"","vetting_questionnaire":{},"approved_by":null,"approved_at":null,"stripe_customer_id":null,"autopay_enabled":false,"autopay_payment_method_id":"","autopay_last_four":"","autopay_bank_name":"","autopay_enrolled_at":null,"autopay_method_type":"ach","autopay_approved_by":null,"autopay_approval_date":null,"autopay_approval_reason":"","credit_balance":"0.00","customer_type":"tenant","is_billable":null,"photo_url":"","marketing_tags":[],"base_user":null,"note_entries":[],"created_at":"2026-02-24T21:33:08.467427","updated_at":"2026-02-24T21:33:08.467430"},{"id":"a675c33c-0d1a-4955-93c0-4f314a7ca371","full_name":"ZULEMA ALEJANDRE","first_name":"ZULEMA","last_name":"ALEJANDRE","company_name":"","email":"ess-no-email-f2ce406fc88fdaf06c54@example.invalid","phone":"(707) 208-2032","alt_phone":"","preferred_contact_method":"email","address_line1":"","address_line2":"","city":"","state":"","postal_code":"","country":"","emergency_contact_name":"","emergency_contact_phone":"","alternate_contact_name":"","alternate_contact_phone":"","alternate_address_line1":"","alternate_address_line2":"","alternate_city":"","alternate_state":"","alternate_postal_code":"","drivers_license_number":"","drivers_license_state":"","employer_name":"","employer_phone":"","intended_uses":[],"security_question":"","security_answer":"","access_code":"","gate_code":null,"brevo_contact_id":"","notes":"","vetting_tier":"T0","vetting_status":"pending","vetting_flags":[],"vetting_notes":"","vetting_questionnaire":{},"approved_by":null,"approved_at":null,"stripe_customer_id":null,"autopay_enabled":false,"autopay_payment_method_id":"","autopay_last_four":"","autopay_bank_name":"","autopay_enrolled_at":null,"autopay_method_type":"ach","autopay_approved_by":null,"autopay_approval_date":null,"autopay_approval_reason":"","credit_balance":"0.00","customer_type":"tenant","is_billable":null,"photo_url":"","marketing_tags":[],"base_user":null,"note_entries":[],"created_at":"2026-02-24T21:33:08.467490","updated_at":"2026-02-24T21:33:08.467493"}

A lot of these field names are empty, though I think that is due to them being businesses rather than individual people, so a lot of them might not apply. I am also way too lazy to list out the rest of the field names and sample data of the other files. They aren't really as important as the customers.json file anyways. Either way, I am sorry.

Enjoy <3