A bug in the web app has exposed details of more than half a million Neighborhood Watch members
Neighborhood Alert, a members-only messaging app in Britain, leaked sensitive user data to anyone who would look, experts have revealed.
In Britain, citizens can form neighborhood watch groups, which have their authorized administrators and other members. To communicate, members can use various apps, including Neighborhood Alert, according to a report from The register supported by national and regional local authorities, and had more than half a million members.
The app, which was available via both the web and a mobile app, contained a lot of personally identifiable information (PII) about its users, including full names, home and email addresses and, if users provided them, phone numbers and profile images.
Confirmation of the error
The app also allowed platform coordinators to create “schemes” – sub-regions of cities – by drawing an area on the map. The scheme could be as large as the coordinator wanted, but was only limited to the region in which they were registered. Once the schedule was drawn, the coordinator could see all registered members inside.
The problem here is that anyone can register as a platform coordinator and anyone can create a schedule. The Register tested this idea, using false information and a discarded email address to successfully register, set up a scheme, and obtain sensitive user data almost immediately. The sensitive data obtained in this way belonged to all kinds of people, including police officers, MPs and other high-profile individuals ‘with a reasonably high expectation of privacy’.
The company behind the app is called VISAV, the publication said. The company was notified of the security flaw and responded by closing the hole and apologizing for the error.
Mike Douglas, product director and data protection officer at VISAV, said: “The anomaly was immediately resolved and we have voluntarily notified every member to inform them and provide guidance, even the vast majority of members who may not be affected by it were affected. We have also reported to the regulator to support our own intensive investigation and help prevent future risks.”