topic Re: Customer data leakage in Archived Posts

Customer data leakage

Juamei — Sat, 11 Sep 2021 15:28:19 GMT

Hey,

You are exposing customer names and numbers to other customers by accident. Looks to be a cached call, possibly via a cdn. Try to add another phone to your account (Android on Chrome on the ee website). There is a bit of text at the top which should say the logged in customer and name but instead may say another customers. My name is neither Elena or Haider but as you can see in the attached screenshots, that's what the website said...

I'm

I'm a senior sw engineering manager for a digital agency, I've seen this class of bug a few times. You need to make the call with unique parameters or (better) whitelist it on the cache.

Re: Customer data leakage

Chris_B — Sat, 11 Sep 2021 15:47:11 GMT

@Juamei You need to report this to customer services not post it on a public forum. If there is some sort of breach your showing the whole world.

Re: Customer data leakage

Juamei — Sat, 11 Sep 2021 15:50:57 GMT

Well I asked on Twitter and was ignored and pointed it out on webchat but was told I had made a mistake. Do neither of those go to customer services?

Re: Customer data leakage

Landerz44 — Sat, 11 Sep 2021 15:51:24 GMT

I have experienced this too. Huge data protection issue for EE yet when I informed them the response I got is they are aware of the issue. That was all.

Re: Customer data leakage

Juamei — Sat, 11 Sep 2021 16:00:14 GMT

That's not great. When did you inform them? Disabling the functionality wouldn't be hard, couple of hours max plus testing and deployment time.

Re: Customer data leakage

Landerz44 — Sat, 11 Sep 2021 16:03:22 GMT

I called them an hour ago roughly. They spieled out some technical things and said their aware of the issue. I do not think EE realise the impact of a data breach.

Re: Customer data leakage

Juamei — Sat, 11 Sep 2021 16:19:03 GMT

My wife has a separate ee account and just managed to get my name and number!!

Re: Customer data leakage

Juamei — Sat, 11 Sep 2021 16:45:59 GMT

Reported as a data breach via customer services. Will delete this thread when happy it's being actioned.

Re: Customer data leakage

XRaySpeX — Sat, 11 Sep 2021 20:45:10 GMT

You can't delete threads. You may select a post as a Solution if you like.