← Microsoft

38M records exposed via Power Apps misconfiguration

2021 38.0M records affected Share on X

Data compromised

Addresses, Social Security numbers

Technical writeup

Misconfigured Microsoft Power Apps portals led to at least 47 organizations exposing 38M+ records (American Airlines, Ford, NY MTA, etc.). Data included COVID-19 info, SSNs, addresses. Discovered by UpGuard.

Root cause

Third-party misconfiguration of Power Apps; no default safeguards.

References