PumpUp
Original Release Date: 6/12/2018
Summary
Security researcher Oliver Hough discovered that a popular fitness app company, PumpUp, left a backend server exposed to the internet without a password, allowing unauthorized access to over six million users’ private and sensitive data. The exposed server, hosted on Amazon’s cloud, contained users’ email addresses, personal information entered into the app, full resolution profile photos, IP addresses, session tokens, and, in some cases, unencrypted credit card data including card numbers, expiration dates, and card verification values.
Recommendations
The NJCCIC recommends PumpUp app users review the ZDNet report and change their passwords for all accounts associated with the app immediately. Additionally, we recommend administrators of Amazon cloud services review our previous NJCCIC Cyber Alert on the risks associated with misconfigured databases, audit their security settings, and implement the mitigation strategies provided as soon as possible.
The NJCCIC is a component organization within the New Jersey Office of Homeland Security and Preparedness. We are the State's one-stop-shop for cyber threat analysis, incident reporting, and information sharing and are committed to making New Jersey more resilient to cyber threats by spreading awareness and promoting the adoption of best practices.
View our Privacy Policy here.
View our Site Index here.