The records of 2.2 million individuals and organisations suspected of being involved in terrorist activity or financial crime have been leaked on the public Internet.
Thomson Reuters' WorldCheck database is used by the world's biggest banks and government intelligence agencies as an AML and sanctions screening reference source.
The data leak, which comes from a 2014 version of the database, was spotted by security researcher Chris Vickery.
"There was no protection at all. No username or password required to see the records," Vickery told the BBC. "I want to be clear that this unprotected database was not directly hosted by Thomson Reuters itself."
In a statement to Finextra, a Thomson Reuters spokesperson says: “Thomson Reuters was yesterday alerted to out-of-date information from the World-Check database that had been exposed by a third party. We are grateful to Chris Vickery for bringing this to our attention, and immediately took steps to contact the third party responsible - as a result we can confirm that the third party has taken down the information. We have also spoken to the third party to ensure there will be no repetition of this unacceptable incident.”