Polarsteps data privacy vulnerability

Investigations by Follow the Money (FTM) revealed a significant security vulnerability in the Dutch travel application Polarsteps. The flaw, located in the app’s Application Programming Interface (API), reportedly allowed unauthorized access to the personal data of approximately 23 million users.

Researchers and investigators claimed the vulnerability enabled the scraping of over 1 billion GPS location points from nearly two million trips, as well as hundreds of millions of photos and videos. The reports indicated that sensitive information, such as home addresses derived from photo metadata, was accessible. Furthermore, investigators noted that even accounts and trips explicitly set to ‘private’ appeared to be accessible through the unsecured API.

Polarsteps has disputed the characterization of the event as a data breach, asserting that the information accessed was primarily “publicly available” and that no authentication was bypassed. While the company maintains that trips set to ‘Only me’ remained private, it acknowledged that its security against large-scale data scraping could be improved. In response to the findings, Polarsteps has implemented rate limiting, tightened API security, and updated default user-tracking settings.