Microsoft
Ford, Other Companies Vulnerable as Millions of Microsoft Stored Data Mistakenly Exposed

Ford, Other Companies Vulnerable as Millions of Microsoft Stored Data Mistakenly Exposed

Aug. 25, 2021
The data, including names, addresses, financial information and Covid-19 vaccination statuses, was made vulnerable -- but not compromised -- before the problem was resolved.

Some 38 million records stored on a Microsoft service, including private information, were mistakenly left exposed this year, security firm UpGuard said on August 23.

The data, including names, addresses, financial information and Covid-19 vaccination statuses, was made vulnerable -- but not compromised -- before the problem was resolved, according to the digital security company's investigation.

Among the 47 affected organizations were American Airlines, Ford, JB Hunt and public agencies such as the Maryland Department of Health and New York City's public transit system.

They all used a Microsoft product called Power Apps, which allows for the creation of websites and mobile apps to interact with the public.

The service's default software configuration setting meant the data of the affected organizations was left without protection up until June 2021, according to UpGuard.

"As a result of this research project, Microsoft has since made changes to Power Apps portals," the report said.

Microsoft said it had let clients know when potential security risks were uncovered so that they could fix the problems themselves.

"We take security and privacy seriously, and we encourage our customers to use best practices when configuring products in ways that best meet their privacy needs," a spokesperson said.

But UpGuard said it would have been better to change the way the software works at the source, and based on how customers use it, rather than "to label systemic loss of data confidentiality an end-user misconfiguration, allowing the problem to persist."

Copyright Agence France-Presse, 202

About the Author

Agence France-Presse

Copyright Agence France-Presse, 2002-2024. AFP text, photos, graphics and logos shall not be reproduced, published, broadcast, rewritten for broadcast or publication or redistributed directly or indirectly in any medium. AFP shall not be held liable for any delays, inaccuracies, errors or omissions in any AFP content, or for any actions taken in consequence.

Sponsored Recommendations

Voice your opinion!

To join the conversation, and become an exclusive member of IndustryWeek, create an account today!