By 
Cybernews’ research team has uncovered that the travel service company Daytrip has exposed 472k user records and 762k detailed travel orders.
RELATED: Data leak exposes 3 billion users: Is your data at risk?
The leak revealed copious details, ranging from names and surnames to PayPal emails, pick-up/drop-off addresses, and more.
“The compromised database was apparently under the control of a Daytrip subcontractor, emphasizing the importance of strict vendor management and consistent security practices across all data handlers in the supply chain,” Cybernews researchers said.
To read the full research, please click here.
What data was exposed?
- Names and surnames
- PayPal emails
- Emails
- Phone numbers
- Dates of birth
- Partial payment details
- Billing information
- Pick-up and drop-off addresses
- Passenger details
- Fees
- VIP flags
Cybernews researchers pointed out that it’s not surprising that an online ride-hailing service stores large swaths of information, as it has become the norm in the industry. However, data security is no joke in such matters.
Shortly after contacting Daytrip, the database was closed.
The company claimed, “As part of this commitment, we regularly review our partnerships and have discontinued working with the vendor in question to ensure alignment with our high standards of security and service.”
Why could this leak be dangerous?
While there’s no indication malicious actors got a hold of the data, threat actors have automated tools that scour the web for unprotected instances only to download them immediately. The leak also carries a perfect blend of data for identity theft and financial fraud.
Additionally, attackers can craft convincing scams using names, birth dates, and payment details, with PayPal emails serving as a basis for targeted phishing attacks.
Leaking physical addresses and travel patterns may lead to tangible dangers. Attackers could use pick-up and drop-off details to determine when specific individuals leave the house. Moreover, VIP flags could help crooks identify high-value targets.
Credit: Cybernews
