According to reports, approximately 20 million users of free Virtual Private Network (VPN)have had data .
As researchers at vpnMentor cybersecurity, they discovered an unsecured server, which is used by many VPNs, that was “completely open and accessible, exposing private user data for anyone to see.”
The apps affected by the leak are UFO VPN, FAST VPN, Free VPN, Super VPN, Flash VPN, Secure VPN , and Rabbit VPN.
Lead researcher Noam Rotem said his team found entries within the exposed database containing personal information such as email, home addresses, clear text passwords, IP addresses and other information that could allow an individual to be identified.
“The lack of basic security measures in a critical part of a cybersecurity product is not just shocking. It also shows a complete violation of standard VPN practices that put their users at risk,” Rotem said.
In fact, some of these VPNs offer premium services for a small fee. The researchers were able to gain access to user data in this case as well.
According to the research, the applications on the exposed server have a common owner and developer based in Hong Kong.
Representatives from UFO VPN and Fast VPN stated the following:
“Due to staff changes caused by COVID-19, we did not immediately find the errors in the server firewall, which would have led to the potential risk of a breach. They have now been fixed.”.
Mobipotato, the company representing FastVPN, confirmed that the server was exposed from June 29 to July 13.
The other companies affected by the leak have not commented on the matter.
Tech expert Trevor Long advises internet users not to use free VPN services. “VPNs are an excellent and recommended way to ensure your security, especially when you’re on a public Wi-Fi or working remotely from your home or office, but you should trust a larger VPN company,” he said.
