App users were able to see other customers’ data, including names, dates of birth and mobile numbers.
The popular petrol-buying app run by 7-Eleven has suffered a data breach that allowed customers to view the names, email addresses, mobile numbers and dates of birth of other users.
The 7-Eleven fuel app, which the company said this week has been downloaded two million times, was taken offline for a matter of hours on Thursday after a customer alerted the company to the fact that he was able to access the personal information of several other customers via the app.
The app allows users to pay in advance for fuel and lock in lower petrol prices for when they need to fill up.
The customer, who asked not to be named, said he discovered the fault on Thursday when he opened the app and found someone else’s information, including the amount of money in their account, their name, email address, phone number, and date of birth. He logged back out and in several times, and other people’s information appeared in the account when he logged back in.
He alerted 7-Eleven, which took down the app yesterday for maintenance, much to the frustration of several customers on the company’s Facebook page.
A spokesperson for 7-Eleven said the app was brought back online at 5.30pm, but declined to answer any questions about the data breach, stating the matter was under investigation.
“The 7-Eleven Fuel App experienced a technical issue. The issue has been resolved, and the 7-Eleven Fuel App is now online for all customers. We are continuing to investigate and have informed the relevant authorities,” the spokesperson said.
Under Australian law, companies are required to inform the office of the Australian information commissioner and affected people when a data breach involving personal information is likely to result in serious harm.
A spokesperson for the commissioners’ office confirmed that the notification had occurred.
“We can confirm we have been notified about a potential data breach involving 7-Eleven,” the spokesperson said.
In the 2018-19 financial year, the office took 1,160 reports of data breaches, including 950 under the mandatory data breach notification scheme.
Extracted from The Guardian