Page 3 - Test Partners News Today

Peloton API Exposed User Data, Even for Private Accounts Photo: Scott Heins/Stringer (Getty Images) Peloton’s had a rough go in the news cycle lately, and not helping matters is the fact that its leaky API allowed any hacker to obtain any user’s account data—even if that user had set their profile to private. Advertisement The vulnerability, which was discovered by security research firm Pen Test Partners, allowed requests go through for Peloton user account data without checking to make ...

minute read Share this article: On top of the privacy spill, Peloton is also recalling all treadmills after the equipment was linked to 70 injuries and the death of one child. Peloton has hit a pothole. Its API was leaking riders’ private data, it ignored a vulnerability disclosure from a penetration testing company, and it partially fixed the hole but didn’t get around to telling the researcher until he reached out to a cybersecurity journalist for some help. This is bad news...

Writing in a blog post, Pen Test Partners also said the flaw meant that users’ precise location data, as well as personal information and private chats were leaked. The firm went on to explain that “the risk of personal data leakage seems more likely to be exploited and give reward to an attacker” than locking someone in their device. Pen Test Partners first learned of the flaw in April 2020, and, after contacting Qiui with the problem, received assurances that it would be fixed. On June ...