Rapido Fixes Bug That Exposed Personal Data of Thousands of Users, Drivers

Rapido data leak: A major bug in the app of the Indian bike-taxi aggregator, Rapido, exposed the personal data of thousands of users and drivers across the country. The exposed data includes personal details such as full names, email addresses and phone numbers of individuals.

According to a report by TechCrunch, an Indian security researcher, Renganathan P, discovered a bug in a form on the Rapido website that is used for collecting feedback from the company's auto-rickshaw users and drivers. This bug pertains to one of the APIs used by Rapido that is used for collecting and sharing information from the feedback form with a third-party service used by the company.

The research told the publication that this bug exposed the names and phone numbers of the users and drivers -- something that can be a security hazard for the users and open doors for potential cyber attacks. The researcher also told the publication that the bug could have also led to hackers 'performing a large-scale social engineering attack' or sharing the exposed data on the dark web.

In total, the website exposed the feedback forms of over 1,800 forms, which also includes the phone numbers of the company's drivers.

As per the report, the Bengaluru-based company set the exposed portal to private as soon after. Rapido, in a statement to the publication, said that the collected phone numbers and email addresses were 'non-personal' in nature.

"While this is being managed by external parties, we have come to understand that the survey links have reached some unintended users from the public," the company spokesperson told the publication.

The news comes a day after a bug in McDonald India's delivery system (West and South) exposed the data, which includes details such as names, phone numbers and email addresses, of thousands of customers and delivery partners in the country. In addition to exposing data, the bug could let anyone access, redirect and track orders in real-time.

A security researcher shared details of the bug in July and fixed by the company in late September.