Airtel Mobile App Security Flaw Exposes Personal Data Of 32 Crore Subscribers

One of the mobile applications of Bharti Airtel has been found to have a security flaw compromising the data of nearly 32 crore subscribers. The telecom major, however, has claimed to have contained the data breach that exposed “sensitive user information”.

Bengaluru-based independent cybersecurity researcher Ehraz Ahmed, who was the first to observe the technical glitch, said in his blog that the fault existed in Airtel’s API (Application Program Interface) that enabled people to “to fetch sensitive user information of any Airtel subscriber.”

He also released a video demonstrating a script being used to get information from the Airtel’s mobile app’s API.

“It revealed information like first and last name, gender, email, date of birth, address, subscription information, device capability information for 4G, 3G & GPRS, network information, activation date, user type (prepaid or postpaid) and current IMEI number,” Ahmed said in his blog.

The IMEI number is a unique number that can be used to identify the device of the user. “Every user that is on India’s Airtel network was at risk of getting his information leaked through this vulnerability, and risking over 325.5 million subscribers in India,” Ahmed said.

Meanwhile, when contacted Bharti Airtel spokesperson acknowledged the flaw and said that it was been fixed as soon as the company was alerted.