WeWork India rectifies glitch that revealed visitors’ personal data

WeWork Inc., a flexible workspace solutions company, has reportedly corrected a security flaw that gave unrestrained access to the personal details and selfies of several users who visited its coworking spaces.

Sandeep Hodkasia, a security consultant, discovered guest data leaking from the check-in app of WeWork India's website which visitors used to sign in at the multitude of WeWork India areas in the country. Due to a glitch in the app, any user's check-in file could be accessed by raising or lowering their sequential user ID by a single number.

Since the check-in tool was on the internet, the error enabled anyone on the web to spiral through thousands of files, uncovering identities, selfies, email addresses, and contact information. According to Hodkasia, in addition to the data not being encrypted, there were also no noticeable regulations in position to stop access to the huge amounts of data.

Apoorva Verma, a spokesperson from WeWork India confirmed that its website had a defect that permitted unintended access to the basic visitor information, which was later removed. He added that WeWork India was in the middle of making changes to the website and the recent alterations have remedied the whole episode.

However, the time duration and the exact number of people whose information had been exposed remains unknown. 

As per India's new data breach reporting rules, which necessitate businesses to inform the authorities of a security breach within six hours of realization, are yet to go into effect due to a delay in their implementation. Hence, when asked about their plans to alert those whose information had been compromised, the company declined to comment. 

It is worth noting that WeWork India joins a slew of Indian organizations that have been hit by cyber incidents in the last year. 

Source credits:

https://techcrunch.com/2022/07/04/wework-exposed-visitors-data/