Data breach at Massage chain reveals personal data and comments about creepy customers

quote:

---

Urban Massage, a popular massage startup that bills itself as providing “wellness that comes to you,” has leaked its entire customer database.

The London, U.K.-based startup — now known as just Urban — left its Google-hosted ElasticSearch database online without a password, allowing anyone to read hundreds of thousands of customer and staff records. Anyone who knew where to look could access, edit or delete the database.

...Among the records included thousands of complaints from workers about their clients. The records included specific complaints — from account blocks for fraudulent behavior, abuse of the referral system and persistent cancelers. But, many records also included allegations of sexual misconduct by clients — such as asking for “massage in genital area” and requesting “sexual services from therapist.” Others were marked as “dangerous,” while others were blocked due to “police enquiries.” Each complaint included a customer’s personally identifiable information — including their name, address and postcode and phone number.

---