← Hyundai Motor India

2023 Hyundai Motor India — customer data via URL bug

2023 Unknown records affected Share on X

Data compromised

Names, addresses, emails, phone, vehicle data

Technical writeup

Bug in WhatsApp repair links: phone number in URL allowed access to other customers' data. Exposed names, addresses, emails, phone, vehicle registration, engine numbers, mileage. Fixed Jan 2024.

Root cause

IDOR; URL parameter exposure

References