- Researchers from AppOmni found a misconfiguration bug in sites built with Microsoft Power Pages
- As a result, data on millions of people was leaking on the web
- UK NHS among affected firms, with other urged to investigate immediately
Businesses in both the private and public sector have been leaking personally identifiable information (PII) on millions of people due to a fault with a Microsoft website builder platform.
Experts from AppOmni revealed the leak stems from misconfigurations in Microsoft’s Power Pages, a low-code platform within the Microsoft Power Platform suite that allows users to build websites without needing to be expert coders.
However, due to misconfigured access controls – namely excessive permissions granted to the Anonymous role – many websites were leaking “significant amounts of data”. That information included full names, email addresses, phone numbers, and home addresses.
NHS among those affected
Power Pages is especially geared toward business users and developers who need to build sites that integrate with business data from sources like Microsoft Dataverse, and apparently has more than 250 million monthly users.
“During my research, I’ve uncovered several million records of sensitive data being exposed to the public internet from authorized testing alone,” the researcher said, suggesting that the leak is probably even bigger (since this was found from “authorized testing alone”). The primary nature of this data are internal organization files and sensitive PII belonging to both internal organization users and other users registered on the website.
Among the leaksters was the NHS – UK’s National Health Service – which allegedly leaked sensitive information belonging to more than 1.1 million employees. The healthcare giant has since plugged the hole. The researchers did not want to name any other organizations leaking the data, possibly because the holes have not yet been plugged.
Misconfigured databases are one of the main causes of data leaks. Over the years, there were many instances of organizations keeping large archives of sensitive customer files without even a weak password, let alone a strong one.