3.5M users' dinner habits exposed in data leak
FreshMenu, which delivers food to Bangalore, Mumbai, Gurgaon, and Delhi, has exposed its customer data to the public.
By Cybernews
FreshMenu, a popular food delivery service, has exposed over 3.5 million order details along with sensitive customer information, including phone numbers and food delivery addresses.
FreshMenu, which delivers food to Bangalore, Mumbai, Gurgaon, and Delhi, has exposed its customer data to the public, recent research by the Cybernews research team has revealed.
Researchers stumbled upon a 26GB-strong MongoDB database that wasn’t secured with a password, meaning that anyone could potentially access it. The database contained over 3.5 million orders.
While users might not really care if threat actors find out what they’ve ordered, unfortunately, the company also exposed customer data along with their orders, including:
- Names
More from Cybernews
Sainsbury’s installs more facial rec tech in stores: Should shoppers be worried?
"Phantom squatting” uses AI hallucinated domains for cyber attacks
What they’re doing to gamers is a robbery in broad daylight
Irish parliament expands Microsoft use, despite the EU’s efforts to ditch it
Can government AI actually scrub UAP footage from the internet?
The EU and Apple CEO Tim Cook held "constructive" talks after their Siri AI dispute in Europe
- Emails
- Phone numbers
- Billing and shipping addresses
- IP addresses
As per our researchers, the database wasn’t exposed for long – only around 2-3 days. However, it takes mere seconds for threat actors to dump discovered open sets of data using automation, and companies need to make sure that sensitive information is always hidden from the public eye.
We sent out a responsible disclosure to the company on December 14th. We received no reply, but the database was secured. We’ve also reached out to FreshMenu for an on-the-record comment but received no response before going to press.
“The exposed data provides threat actors with the potential to engage in identity theft, phishing attacks, and targeted scams. The comprehensive nature of the leaked information could enable malicious actors to exploit customer vulnerabilities, compromise privacy, and potentially perpetrate fraudulent activities,” Cybernews researchers noted.
