2019 Foodpanda India — email-parameter account takeover / PII exposure (web); bug bounty remediation
Data compromised
Account profile and order-linked PII as described in disclosure-era reporting—scope and duration not quantified
Technical writeup
HuffPost India reported that a security researcher demonstrated a serious logic flaw on Foodpanda’s India web properties (then tied to Ola’s food-delivery push): by manipulating POST data—substituting another user’s registered email—the application could return an “email exists” style condition yet, after refresh, bind the session to the victim account without password or SMS OTP. The article described exposure of names, mobile numbers, addresses, email IDs, and order context, and noted concerns about plaintext-in-transit handling in the tested flow before remediation. Foodpanda publicly denied a “breach” while crediting its bug-bounty program and fix; independent experts quoted in the same piece treated it as a material PII exposure risk.
Root cause
Insecure session/account binding tied to client-supplied identity parameters (email substitution) without re-authentication