Urban Massage Data Breach Exposed Sensitive Comments On Its Creepy Clients

An anonymous reader shares a report from TechCrunch: Urban Massage, a popular massage startup that bills itself as providing 'wellness that comes to you,' has leaked its entire customer database. The London, U.K.-based startup -- now known as just Urban -- left its Google-hosted ElasticSearch database online without a password, allowing anyone to read hundreds of thousands of customer and staff records. Anyone who knew where to look could access, edit or delete the database. It's not known how long the database was exposed or if anyone else had accessed or obtained the database before it was pulled. It's believed that the database was exposed for at least a few weeks. Urban pulled the database offline after TechCrunch reached out. Among the records included thousands of complaints from workers about their clients. The records included specific complaints -- from account blocks for fraudulent behavior, abuse of the referral system and persistent cancelers. But, many records also included allegations of sexual misconduct by clients -- such as asking for 'massage in genital area' and requesting 'sexual services from therapist.' Others were marked as 'dangerous,' while others were blocked due to 'police enquiries.' Each complaint included a customer's personally identifiable information -- including their name, address and postcode and phone number.

Read more of this story at Slashdot.