An app-building tool from Microsoft somehow leaked data from over 38 million people

Just a heads up, if you buy something through our links, we may get a small share of the sale. It’s one of the ways we keep the lights on here. Click here for more.

An app-building tool created by Microsoft has leaked the data of roughly 38 million people online. The reason for the leaks? Improperly configured privacy settings, which were set to give public API access by default.

The security company that discovered the leak says there’s no evidence that data was exploited, and Microsoft has since fixed the issue.

Back in May of this year, security researchers at UpGuard noticed one such app created by Microsoft’s Power Apps platform that was “misconfigured to expose data.” They wondered if it was just that one app, or if it was a “systemic issue” on the platform.

Well, it didn’t take long before they realized it was systemic, with organizations like Ford, American Airlines, J.B. Hunt, and multiple state agencies from Maryland, New York City, and Indiana all exposing user data publicly.

Even Microsoft wasn’t immune, with a handful of old databases exposed to the public. That data ranged from names, phone numbers, and even social security numbers, and even some medical data as some of the sites were being used to organize COVID-19 vaccination efforts.

If you’ve never heard of Power Apps before now, you’re not alone. We had to dig into the platform as well, and found that it’s a no-code way to make simple websites or apps, covering both the public-facing site and the backend that handles the data. While the developer docs for the permissions do talk about the issues regarding misconfiguration, the default when these feeds are enabled is that anyone can view them.

Microsoft eventually created a tool to audit Power Apps portals for the correct table permissions and is planning changes to the platform so that table permissions will be enforced by default. That should stop this issue from happening in the future, but it’s a stark reminder that well-intentioned default settings can go awry.

Have any thoughts on this? Let us know down below in the comments or carry the discussion over to our Twitter or Facebook.

Editors’ Recommendations:

• Microsoft is doing everything it can to force you to use the Edge browser with Windows 11
• MS Paint is getting a much-deserved redesign in Windows 11
• T-Mobile reveals hackers stole social security numbers and more from over 47 million people
• A massive LinkedIn data breach has affected over 700 million accounts

Joe Rice-Jones

Maker, meme-r, and unabashed geek with nearly half a decade of blogging experience at KnowTechie, SlashGear and XDA Developers. If it runs on electricity (or even if it doesn't), Joe probably has one around his office somewhere, with particular focus in gadgetry and handheld gaming. Shoot him an email at joe@knowtechie.com.