Whisper left personal data of users exposed for years

Whisper is a message sharing app that rose into prominence around 2012 as it gave users the ability to share their messages and views online anonymously. Now, a report says that users' Whispers, as the apps' anonymous messages are called, might not have been so anonymous anymore.

According to a report by The Washington Post, Whisper left personal information pertaining to users exposed for years. While the exposed information did not include users' real names, however, the exposed database did contain users' age, ethnicities, gender, home town, nicknames. The database also includes locations associated with users' last Whispers, some of which are linked to schools, workplaces, residential neighbourhoods and military bases.

What's more? Researchers, who discovered the exposed database, were also able to access users' accounts and see which messages a user responded to and their last log-in time.

But that's not it. As per the report, the exposed database was not password protected. Meaning, anyone could access them. Cybersecurity researchers Matthew Porter and Dan Ehrlich, who also alerted the company and law enforcement agencies about the leak, said that they were able to access nearly 900 million user records from the app starting from 2012 to March 2020.

ALSO READ: Google warns Indian users of data breach after Chrome 79 bug

In response, MediaLab, Whisper's parent company, has taken down the database and disputed the findings of the report.

"The posts and their ties to locations, ages and other data represents a consumer facing feature of the application which users can choose to share or not share," Lauren Jamar VP of content and safety at MediaLab told the publication in a statement.