A database problem with a U.S. domain name registrar exposed sensitive financial and personal information relating to thousands of domain name registrations, a Dutch company said Friday.DiscountDomainRegistry.com of New York fixed the problem shortly after being notified Thursday, said Nico Vandendries, chief executive officer (CEO) of Strongwood, a private investigation company based in the Netherlands.DiscountDomainRegistry.com CEO Alex Brecher said in an e-mail to the IDG News Service that the company is 100 percent positive customer data was not compromised. The "alleged vulnerability," he wrote, was patched within minutes after the company was contacted by Strongwood."We\u2019re in the midst of investigating these allegations, and we cannot provide detailed information at this time," Brecher wrote.Erik Ekkelenkamp, a system project engineer with Strongwood, was researching .eu domain names when he clicked a link within DiscountDomainRegistry\u2019s site. The link led to an error involving execution rights on a MySQL directory. MySQL is a widely used open-source database program.A script plus other programming usually unseen was visible that allowed for a connection to the database, which contained credit card numbers, usernames, passwords and other information, Vandendries said.A DiscountDomainRegistry.com official wasn\u2019t initially convinced there was a problem, Vandendries said."At first, they didn\u2019t believe us until we presented him with his own password," Vandendries said. "And then he knew we were in." On its website, DiscountDomainRegistry.com, founded in 1998, says it registers domain names for US$14.99 per year, including those of Fortune 500 companies.So far, it\u2019s believed no one has exploited the error, which may have existed for up to four months, Ekkelenkamp said. DiscountDomainRegistry.com had changed parts of its website recently, which may have resulted in the bug, he said.The damage could have been severe, Vandendries said. The credit card data and personal information from DiscountDomainRegistry.com clients could have been sold, he said.Further, access to user names and passwords would have allowed an intruder to change the names and IP addresses associated with websites, a method used for so-called "phishing" scams, Vandendries said. Phishing involves tricking users into visiting a website that appears legitimate but actually is a facade. The URL may look authentic but connects to an IP address with a bogus website.The fraudulent websites usually have forms for providing sensitive material, such as financial information, which is then directly sent to scammers. Vandendries estimated it would take "little skill" with MySQL to exploit the bug. "If a bad guy found this leak and had access to the database ... then I\u2019m sure it could have cost millions."Ekkelenkamp said he received a call last night from the owner of DiscountDomainRegistry.com, thanking him.-Jeremy Kirk, IDG News ServiceKeep checking in at our CSO Security Feed page for updated news coverage.