BrewDog exposed data for over 200,000 shareholders and customers

guest · Oct 8, 2021

BrewDog exposed data for over 200,000 shareholders and customers
October 8, 2021
https://www.bleepingcomputer.com/ne...-for-over-200-000-shareholders-and-customers/

BrewDog, the Scottish brewery and pub chain famous for its crowd-ownership model and the tasty IPAs, has irreversibly exposed the details of 200,000 of its shareholders and customers.

The exposure lasted for over 18 months and the point of the leak was the firm’s mobile app, which gives the ‘Equity Punks’ community access to information, discounts at bars, and more.
Click to expand...

As detailed in a PenTestPartners report, the problem lies in the app’s API, and more specifically, its token-based authentication system. The security blunder comes from the fact that these tokens were hard-coded into the mobile application instead of being transmitted to it following a successful user authentication event.

As such, anyone was free to append any customer ID to the end of the API endpoint URL, and access sensitive PII (personally identifiable information) for that customer.
Click to expand...

The flaw existed since March 2020, when BrewDog started using hard-coded tokens with app version 2.5.5. Unfortunately BrewDog’s team missed this flaw for an extended period of time and failed to secure their token system on the multiple subsequent releases that followed.
Click to expand...

To our knowledge, BrewDog has not informed its shareholders and customers of the possibility of their data having been breached. We have reached out to them for a comment but we have not heard back yet.
Click to expand...

PenTestPartners: Free BrewDog beer with a side order of shareholder PII?

TL;DR

BrewDog exposed the details of over 200,000 ‘Equity for Punks’ shareholders for over 18 months plus many more customers

Every mobile app user was given the same hard coded API Bearer Token, rendering request authorisation useless

It was therefore trivial for any user to access any other user’s PII, shareholding, bar discount, and more

Disclosure was rather fraught. Instead of being ‘cool’ as we had hoped, given their reputation as being a bit counter-culture, BrewDog instead declined to inform their shareholders and asked not to be named. It took 4 failed fixes to properly resolve the problem.

It’s public knowledge that BrewDog are considering an IPO. We are concerned for future investors if BrewDog’s wider approach to security and disclosure is this weak.

But, best of all, shareholders get a free beer on the 3 days before or after their birthday under the terms of the Equity for Punks scheme. One would simply access an account with the required date of birth, generate the QR code and the beers are on BrewDog!

Click to expand...

Log in or Sign up

BrewDog exposed data for over 200,000 shareholders and customers

guest Guest

Log in or Sign up

BrewDog exposed data for over 200,000 shareholders and customers

guest Guest

Useful Searches