Close to 40 Million Records Leaked Through Poor Power Apps Settings
Security researchers discovered that around 38 million data records have been exposed online. The data leak was caused by poorly configured instances of Microsoft Power Apps. The leaked data includes Covid vaccination information, emails and social security numbers.
Wired reports that data stored by large companies has been exposed online. The names of entities that were leaking records due to the configuration issues include NY city public schools, the health department of the state of Indiana, as well as American Airlines and vehicle manufacturer Ford.
The leak was discovered by researchers working with security firm Upguard, who started their investigation a few months ago. The ultimate result was that the leaky data, while supposedly secured, was publicly accessible to anyone on the internet.
The issue was caused by the fact that Power App APIs make data collected using the API public when using the default settings. If the owner of the respective app portal wants to have this information properly secured, they would need to reconfigure the API and app used to make the data secure and private.
Researchers involved in the investigation notified Microsoft about the issue, sending links to the specific Power App portals that were leaking data. Somewhat confusingly, after a brief exchange with Microsoft, researchers were told that the issue was resolved, as this behavior was deemed to be "by design".
Upguard researchers then went on to contact individual companies and entities that were affected by the default configuration issue. Within a few days the vast majority of leaking instances of Power Apps were secured properly and the issue was indeed resolved.
Microsoft did come out with a statement that now anyone using the Power Apps portals will have their collected data secured and set to private by default. Additionally, the software company released a special tool, designed to help customers check the privacy of Power Apps data easily.
There is no information or evidence that the leaking data has been scraped or otherwise abused by malicious actors so far.
The incident has not led to anything close to a data disaster, but it still shows that even a simple oversight and trusting the default settings in a tool you are not entirely familiar with may lead to potential risks and data security issues.
