Zack Whittaker reports:
A popular fitness app that claims over six million users was leaking private and sensitive data, including health information and private messages sent between users.
PumpUp, an Ontario-based company, bills itself as a fitness community, allowing subscribers to discover new workouts and record their results, and get advice from fitness coaches and other users.
But the company left a core backend server, hosted on Amazon’s cloud, exposed without a password, allowing anyone to see who was signing on and who was sending messages — and their contents — in real-time.
Security researcher Oliver Hough found the exposed server and contacted ZDNet to investigate.
Read more on ZDNet.
Once again, we read of a case in which it was too damned hard to notify an entity that they were leaking data. Zack describes the efforts he made and how it took more than one week, and they still didn’t get any response from the firm or its investors, although the server was quietly secured.
What if Zack and the researcher had given up in disgust because spending their life trying to help a company protect consumer personal information is not their job? What then?