Cybernews researchers have found that Tokee, a video and text messaging app, has leaked the details of 1.2 million user profiles, which represents the vast majority of the app’s user base. The exposed data was stored in a MongoDB database, a popular service businesses use to store and process large volumes of data.
Here’s the data that was leaked:
- User display names;
- Phone numbers (stored as numeric values);
- Profile avatars (hosted on Firebase Storage);
- Device tokens used for push notifications;
- User IDs;
- Account creation and update timestamps;
- “Last seen” activity indicators;
- Account status flags (e.g., premium/non-premium);
- The exposed database appears to have stored Tokee’s chat messages, but our researchers say the messages were encrypted.
After the Cybernews team contacted the company and the responsible authorities of the security leak, the exposed database was taken offline.
“Although user chat messages stored in the same infrastructure appear to be encrypted using password-based OpenSSL encryption, the exposed personal data alone presents significant privacy, security, and regulatory risks. The case also reinforces that encryption alone is insufficient without proper infrastructure security,” our researchers explained.
Attackers could exploit the data to track and profile user activity and use leaked tokens for targeted phishing and spam campaigns, increasing cybersecurity risks for app users.
For more information, here’s the full report:
https://cybernews.com/security/tokee-messaging-app-data-leak/
Scouring the internet for mobile tech, news & tips!
