Loading story…
Australian “rent-tech” platforms used by real estate agents to collect and store renter/landlord documentation were reported to have serious security vulnerabilities that left millions of sensitive lease-related documents accessible on the open web. A researcher’s analysis of seven platforms found documents (including lease agreements, identity documents, payslips, and references) could be retrieved through hyperlinks that did not require authentication, could be discovered by web crawlers, and in some cases could be accessed through predictable URL patterns (e.g., incrementing/decrementing an identifier) or guessable links created via URL shorteners; one workflow reportedly issued an authentication cookie after access, potentially exposing broader rental histories and maintenance records.
The reporting also highlighted the broader privacy impact on renters who are effectively compelled to use these platforms throughout the rental lifecycle (applications, payments, maintenance portals, chatbots), despite the data sensitivity involved. When companies were alerted, only two of seven reportedly responded with commitments to add security measures, raising concerns about governance and accountability in the sector. A separate opinion piece about AI/children’s privacy discussed general risks of data aggregation and surveillance but did not provide incident-specific details tied to the rent-tech exposure.
Map this exposure pattern across your cloud, code, and identities.
7 events from the most recent confirmed update back to the earliest known activity.
A follow-up commentary citing the Guardian's reporting said only two of the seven companies contacted indicated they would implement additional security measures. It also highlighted that renters had little practical ability to avoid these platforms despite the privacy risks.
Australia's Office of the Australian Information Commissioner said it had not received breach notifications from the platforms mentioned in the reporting. The regulator also said scrutiny of rent-tech platforms would be a priority in 2026.
Guardian Australia reported that analysis of seven Australian rental platforms indicated millions of leasing-related documents could be accessed by threat actors through predictable or guessable links. The report also said exposed links could be scanned by web crawlers and cached, increasing discoverability.
Inspection Express said it improved its security in January 2026 after being notified earlier, adding expiring links and additional restrictions to document access. This was one of the few concrete remediation steps described by a platform.
Inspection Express said it was alerted to the document exposure problem in the previous year. The company later disputed some of the findings about public discoverability and indexing.
The researcher attempted responsible disclosure by notifying affected rent-tech companies and the Australian Information Commissioner about the document exposure issues. According to later reporting, many of the vulnerabilities remained unresolved months afterward.
An anonymous security researcher found that sensitive renter and landlord documents on multiple Australian rent-tech platforms had been accessible through unauthenticated links, with some exposed files dating back to 2017. The materials included lease agreements, identification documents, payslips, and references.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
theguardian.com
Open sourcetheguardian.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybernews researchers reported multiple **data exposures caused by misconfigured back-end services**, including consumer mobile apps and a large unprotected database. Three widely downloaded Android AI photo identification apps—*Insect Identifier by Photo Cam*, *Dog Breed Identifier Photo Cam*, and *Spider Identifier App by Photo*—reportedly leaked more than **150,000** users’ data via a **Firebase misconfiguration** with inadequate authentication/access controls. Exposed data included email addresses, usernames, profile photos, notification tokens, and **GPS coordinates**; while passwords were not found, researchers noted the location data could enable stalking, doxxing, and targeted scams, and observed indications that automated bots had already discovered the exposed databases prior to the investigation. The apps were attributed to publisher **MobilMinds** (linked to **OZI Technologies**), and the developers reportedly did not respond to requests for comment. Separately, Cybernews identified an **unprotected Elasticsearch cluster** exposing approximately **8.7 billion records** associated with China, including names, birthdates, home addresses, national ID numbers, social media identifiers, usernames, and other account/platform details; the dataset also reportedly contained **plaintext credentials** and corporate/business records, suggesting long-term aggregation. The database’s ownership was not confirmed, but it was subsequently secured; researchers characterized the exposure as a systemic privacy risk potentially affecting hundreds of millions of individuals. Two additional items in the set describe individual bug-hunting writeups (e.g., bypassing mobile controls and abusing password reset/IDOR-style issues) but do not provide verifiable linkage to the specific Firebase/Elasticsearch exposures described above.
Jun 29, 2026
Security researchers reported a **critical Moltbook** exposure caused by an unauthenticated database/API access issue that allowed enumeration of agent records (e.g., `GET /api/agents/{id}`) and leakage of **email addresses, JWT `login_token`s, and third-party `api_key`s**, enabling agent hijacking and downstream abuse of connected services. Separately, **Cal.com Cloud** was found vulnerable to a chained set of broken access controls and signup/invite-token logic flaws that enabled **complete account takeover** and access to sensitive booking data (attendee details, emails, and booking histories) at scale, including organizational accounts. In parallel, SentinelLabs documented that roughly **175,000 internet-exposed Ollama** instances were reachable due to common deployment misconfiguration (binding to `0.0.0.0`/public interfaces), creating conditions for **arbitrary code execution** and access to external resources—especially where tool-calling features were enabled. A distinct IoT case study described **Molekule** air purifiers exposing fleet-wide telemetry because an **AWS Cognito Identity Pool** permitted unauthenticated access to **AWS IoT Core MQTT** subscriptions, leaking device shadow data (e.g., Wi‑Fi SSIDs, MAC addresses, device names, sensor readings) for ~100,000 devices; the disclosed policy reportedly allowed read/subscribe access but not device control without per-device certificates.
Jun 29, 2026
Cybersecurity researchers reported a major exposure at **IDMerit**, an AI-driven identity verification provider, after discovering an unsecured, internet-accessible **MongoDB** instance containing **over 3 billion records** (over 1TB). Exposed data reportedly included full names, addresses, dates of birth, national ID numbers, phone numbers, and email addresses; researchers estimated roughly **~1 billion** records contained sensitive data (with duplicates likely inflating the total). The dataset was described as global in scope, affecting individuals across **26 countries**, with large volumes attributed to the **US, Mexico, and the Philippines**, creating downstream risk for **identity fraud, account takeover, phishing, and SIM-swap** activity. Separately, Australian finance technology platform **youX** confirmed an **unauthorized third-party access** incident, after which a hacker claimed theft of data tied to **444,528** Australian borrowers and additional loan-application and identity data (including driver’s licence numbers, addresses, and credit/banking-related information), plus customer/staff details associated with broker organizations. **Substack** also confirmed unauthorized access to **limited user data** (including email addresses, phone numbers, and internal account metadata) that occurred in **October 2025** but was only identified on **Feb. 3, 2026**; Substack stated **passwords and payment card/financial data were not accessed**, but the extended detection gap raised concerns about monitoring and dwell time.
Jun 29, 2026