Photo Editing App 'Fotor' Exposed 13 Million Private User Records

guest · Dec 16, 2020

Photo Editing App 'Fotor' Exposed 13 Million Users Online
Secure Thoughts collaborated with Security Expert Jeremiah Fowler to expose a massive leak of user information
December 9, 2020
https://securethoughts.com/photo-editing-app-fotor-exposed-13-million-users-data/

On October 15th I discovered a non-password protected database that contained a large number of internal records. There was a total of more than 123 million records exposed that contained a combination of test and production data. The most disturbing part of the discovery was a massive collection of 13 million user records that included their names, email addresses, user ID numbers in plain text.
Click to expand...

I immediately sent a responsible disclosure notice of my findings.
Public access was restricted shortly after my notice.

“[...] Meanwhile, in order to express our appreciation to your alert in a timely manner, we’d like to offer each of you a redeem code for an annual subscription (the 39.99 USD package) of Fotor website service. You are free to either subscribe yourself or send it to a friend”.
This is the first time someone has offered me a free subscription for a service that has just exposed the inner workings of their business, internal network data, and user data online as a reply to my responsible disclosure notification.
Click to expand...

It is unclear how long these records were exposed or who else may have had access to this data. It is also unclear if users were ever informed of the data breach. Fotor (Everimaging Ltd.) is based in Chengdu, Sichuan, China.

According to the description on the Google play store “Fotor is an online photo editing program with 350 million users from all around the globe”. I did see geolocation logging in the user accounts from multiple countries.
Click to expand...

Some US and European laws require companies to notify users if their data has been exposed, but it is unclear if the Chinese based company would face the same requirements. No further reply was given by Fotor or their parent company Everimaging Ltd. at the time of publication.
Click to expand...

Log in or Sign up

Photo Editing App 'Fotor' Exposed 13 Million Private User Records

guest Guest

Log in or Sign up

Photo Editing App 'Fotor' Exposed 13 Million Private User Records

guest Guest

Useful Searches