IoT maker Wyze suffers data leak, exposes personal data of 2.4 million customers
1Reported today on TechSpot
For the full article visit: https://www.techspot.com/news/83354-iot-maker-wyze-suffers-data-leak-exposes-personal.html
IoT maker Wyze suffers data leak, exposes personal data of 2.4 million customers
Details were accessible online for 22 days
What just happened? IoT vendor Wyze, which makes budget smart devices such as security cameras and smart door locks, has confirmed it accidentally left an internal database exposed online, leaking the details of up to 2.4 million customers.
Cybersecurity firm Twelve Security was first to notice and announce the issue. It said the exposed information included email addresses, a list of cameras in the home, API Tokens, WiFi SSIDs, and health data such as height, weight, gender, bone density and mass, protein intake, and more.
"If this was intentional espionage or gross negligence, it remains a malicious action that must be answered in the form of a decisive, external, and fast investigation by US authorities," wrote the Twelve Security researcher.
As per my records, Wyze had huge Elasticsearch cluster publicly exposed. It included 1,807,201,457 records: log data, API requests and events. https://t.co/RtxDLiqPtC
- Bob Diachenko (@MayhemDayOne) 28 December 2019
Wyze co-founder Dongsheng Song has confirmed that the user data was not properly secured and left exposed from December 4 to December 26. He stressed that passwords and personal finance details were not included in the leak, adding that the database -an Elasticsearch system -was not a production system, though it was storing user data.
To help manage the extremely fast growth of Wyze, we recently initiated a new internal project to find better ways to measure basic business metrics like device activations, failed connection rates, etc.
We copied some data from our main production servers and put it into a more flexible