A data breach within Microsoft Power Apps left 38 million records and dozens of organizations exposed online.
More than 1,000 web apps became accessible to anyone after a misconfiguration within Microsoft Power Apps, leading to the exposure of 38 million records which include information such as COVID-19 contact tracing, vaccination sign-ups, job applications, and employee databases, but also data like phone numbers, home addresses, and social security numbers.
Related | Facebook Data Breach: Did They Get Your Data?
Dozens of companies were affected by the breach, including large industry names such as American Airlines, Ford, the New York City public schools, and more.
The breach exposed data stored in Microsoft’s Power Apps portal service, a development platform that allows for the creation of web or mobile apps for external use. Microsoft Power Apps facilitates the management of internal databases, provides a foundation when developing apps, and offers ready-made APIs to interact with that data.
An investigation of Power Apps conducted back in May by UpGuard revealed that when enabling these APIs, the service defaulted to making the data publicly accessible and needed to be changed in the privacy settings by users manually.
As many of them did not enable this privacy configuration process, many customers left the insecure default setting on. Greg Pollock, UpGuard’s vice president of cyber research, said that “because of the way the Power Apps portals product works, it’s very easy to quickly do a survey. And we discovered there are tons of these exposed. It was wild.”
Thankfully in this particular instance, no data was compromised. Still, discovering this insecurity is important because it revealed the oversight in the Power Apps portals design, something Microsoft has since fixed due to customer pressure.
Since then, Microsoft has also changed the data setting on Power Apps portal apps to private by default.
The tech giant issued the following statement to Engadget: “Our products provide customers flexibility and privacy features to design scalable solutions that meet a wide variety of needs. We take security and privacy seriously, and we encourage our customers to use best practices when configuring products in ways that best meet their privacy needs.”
You might also like
More from Tech
TikTok Begins Testing Tako, Its Own AI ChatBot
TikTok Tako is a new AI chatbot that could “radically change search and navigation” in the app. News of the test …
MissJourney AI: Fighting Biased Gender Stereotypes
Missjourney is an AI tool that generates images exclusively of women, from CEOs to leaders, superheroes, doctors and engineers. TEDxAmsterdam Women …
Google Product Studio Lets Merchants Create Product Imagery With Generative AI
Google is launching Product Studio, a new tool that lets merchants create product imagery for free, using generative AI. Google Product …
The OFFICIAL ChatGPT App Launches On iOS
OpenAI is launching an official ChatGPT app for iOS, sending a warning to all the unofficial apps out there. Finally. Months …
Puro Sound Labs launches New “Best Headphones For Kids”
Puro Sound Labs is launching the new BT2200 Plus, widely recognized as the best headphones for kids. The BT2200 Plus follows …
LG Launches Its Giant 49-Inch UltraGear Curved Gaming Monitor
LG's new UltraGear curved gaming monitor aims to compete directly with Samsung’s Odyssey G9, as it beats it on price …
Cala Is A New Web App That Dares You To “Swipe Left” On Meetings
Dubbed the “Tinder for canceling meetings,” Cala web app dares you to swipe left on useless meetings. Cala is a free …
Google I/O Keynote Round-Up: All-In On AI
During its I/O keynote, Google showed off its latest advances in AI, across search, photo editor and Bard, its own …
New Beats Studio Pro Headphones Revealed In iOS Beta
The new Beats Studio Pro headphones could replace the aging Studio 3, adding personalized spatial audio to the Beat's lineup. 9to5Mac …
