Seller Claims FLY Delivery Platform Backend Dump Exposed Sensitive Records
Summary
A forum user known as exfilar claims to sell a full extraction from FLY’s backend, allegedly exposed through missing Firebase rules that allowed unauthenticated Firestore and Cloud Storage access. The claim remains unverified.
Key points
- Forum user exfilar claims to be selling a complete extraction from FLY’s backend.
- The seller alleges missing Firebase rules allowed unauthenticated reading and writing of Firestore and Cloud Storage.
- The claimed dataset contains 47.9 million rows and totals 46.6GB.
- Allegedly exposed records include rider registration numbers, plaintext passwords, customer addresses, entry codes, and payment credentials.
- The article identifies the affected platform as flyfly[.]co[.]kr; the exposure and dataset claims remain unverified.
Article Details
- Victim Organization
- FLY
- Victim Domain
- flyfly.co.kr
- Incident Type
- Alleged data breach involving unauthenticated read and write access to FLY's Firebase backend due to missing security rules.
- Data Types Exposed
- Rider resident registration numbers
- Rider IDs
- Plaintext passwords
- Customer delivery details
- Customer addresses
- Entry codes
- Payment credentials
- Bank details
- Payment keys
- Affected Records
- 47.9 million rows, as claimed by the seller
- Affected Data Size
- 46.6 GB, as claimed by the seller
- Ransom Or Extortion
- The seller reportedly offered the alleged dataset for sale; no ransom or extortion demand is reported.
- Claim Status
- claimed
Threat Actors
Products
Firebase Realtime DatabaseA forum user known as exfilar claims to be selling a complete live extraction from FLY’s backend after Firebase rules were left absent, making Firestore and Cloud Storage readable and writable without authentication.FirestoreA forum user known as exfilar claims to be selling a complete live extraction from FLY’s backend after Firebase rules were left absent, making Firestore and Cloud Storage readable and writable without authentication.Google Cloud StorageA forum user known as exfilar claims to be selling a complete live extraction from FLY’s backend after Firebase rules were left absent, making Firestore and Cloud Storage readable and writable without authentication.