Misconfigured Microsoft Apps Expose 38 Million Sensitive Records Including Contact Tracing

Over one thousand web apps using Microsoft Power Apps have mistakenly exposed 38 million records online, including sensitive data relating to a number of coronavirus contact tracing platforms, vaccination registrations, job application portals, and employee databases.

Wired reports that a thousand web apps have accidentally exposed 38 million records online, including data from coronavirus contact tracing platforms, vaccinations sign-ups, job portals, and employee databases. The records included a wide array of sensitive information including phone numbers, home addresses, social security numbers, and vaccination status. The exposure of sensitive data was caused by the misconfiguration of Microsoft’s Power Apps tool, which is used to manage the database for many apps and web services.

A number of major companies and organizations were affected by the leak including American Airlines, Ford, J.B. Hunt, the New York City Municipal Transportation Authority, the Maryland Department of Health, and New York City public schools.

The data was all stored in Microsoft’s Power Apps portal service which is used to create web or mobile apps for eternal use. Power Apps portals can be used to create both public-facing sites and data management backends for signup systems including job application portals and even vaccine registration sites.

The security firm Upguard began investigating a number of Power Apps portals in May, as it appeared that they had publicly exposed private data. None of the exposed data appears to have been compromised, but the discovery is still major and reveals a huge oversight in the design of the Power Apps portals. Upguard found that when enabling certain APIs on Power Apps, the platform defaulted to making the corresponding data publicly accessible.

Greg Pollock, UpGuard’s vice president of cyber research, commented: “We found one of these that was misconfigured to expose data and we thought, we’ve never heard of this, is this a one-off thing or is this a systemic issue? Because of the way the Power Apps portals product works, it’s very easy to quickly do a survey. And we discovered there are tons of these exposed. It was wild.”

Read more at Wired here.

Lucas Nolan is a reporter for Breitbart News covering issues of free speech and online censorship. Follow him on Twitter @LucasNolan or contact via secure email at the address lucasnolan@protonmail.com