AngelSense exposed location data and personal information of tracked users
AngelSense, an assistive technology company that provides location monitoring devices for people with disabilities, was spilling the personally identifiable information and precise location data of its users to the open internet, TechCrunch has learned.
The company secured the exposed server on Monday, more than a week after it was alerted to the data leak by researchers at security firm UpGuard.
UpGuard shared details of the exposure exclusively with TechCrunch after AngelSense resolved the lapse. UpGuard has since published a blog post on the incident.
The New Jersey-based AngelSense provides GPS trackers and location monitoring to thousands of customers, according to its mobile app listing, and is touted by law enforcement and police departments across the United States.
According to UpGuard's researchers, AngelSense left an internal database exposed to the internet without a password, allowing anyone to access the data inside using only a web browser and knowledge of the database's public IP address. The database was storing real-time updating logs from an AngelSense system, which included the personal information of AngelSense customers, as well as technical logs about the company's systems.
UpGuard said it found customers' personal data, like names, postal addresses, and phone numbers in the exposed database. The researchers said they also found GPS coordinates of individuals being monitored — including associated health information about the tracked person, which included conditions like autism and dementia. The researchers also found email addresses, passwords, and authentication tokens for accessing customer accounts, as well as partial credit card information — all of which was visible in plaintext, UpGuard said.
It's not known exactly how long the database was exposed nor how many customers were affected. According to the database's listing on Shodan, a search engine of internet-facing devices and systems, AngelSense's exposed logging database was first spotted online on January 14, though it may have been exposed some time earlier.
AngelSense chief executive Doron Somer confirmed to TechCrunch that the company took the exposed server offline after initially identifying UpGuard's first email as spam.
"It was only when UpGuard phoned us that the issue was raised to our attention," Somer said. "Upon its discovery, we acted promptly to validate the information provided to us and to remedy the vulnerability."
"We note that other than UpGuard, we have no information suggesting that any data on the logging system potentially was accessed. Nor do we have any evidence or indication that the data has been misused or is under threat of misuse," Somer told TechCrunch, claiming that the data "was not sensitive personal information."
Somer would not say if the company has the technical means to determine if there was any access to the unprotected server prior to UpGuard's discovery.
When asked if the company planned to notify affected customers and individuals whose data was exposed, Somer said the company was still investigating.
"If notice to regulators or persons is warranted, we will of course provide it," Somer said.
Somer did not respond to a follow-up inquiry by press time.
Database exposures are often the result of misconfigurations caused by human error, rather than malicious intent, and have become an increasingly common occurrence in recent years. Similar security lapses of exposed databases have resulted in the spill of sensitive U.S. military emails, the real-time leak of text messages containing two-factor codes, and chat histories from AI chatbots.
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Fox News
4 hours ago
- Fox News
Extra: A Former Hamas Hostage Returns Home. His Father Tells His Story.
Edan Alexander, an American taken hostage during the Oct. 7, 2023, Hamas attack on Israel, returned to the United States this week and was given a big welcome by his hometown of Tenafly, New Jersey, on Thursday afternoon. Edan was serving in the Israeli Defense Forces when Hamas terrorists ambushed and captured him. For 584 days, Edan was a hostage in the Gaza tunnels until he was freed on May 12th of this year. Just days before his return to the U.S., his father, Adi Alexander, joined FOX News Rundown host Dave Anthony to describe what Edan endured while he was being held captive and how difficult it was for him and his family knowing their child was in so much danger. Adi also weighed in on the multiple wars Israel is engaged in and his hopes that the remaining hostages being held by Hamas will be released. We often must cut interviews short during the week, but we thought you might like to hear the full interview. Today on FOX News Rundown Extra, we will share our entire interview with Adi Alexander, allowing you to hear about Edan's harrowing story of survival and how his family never lost hope during the treacherous ordeal. Learn more about your ad choices. Visit
New York Post
5 hours ago
- New York Post
Grieving parents awarded $2.25M after Georgia doctor plastered videos of their decapitated baby on social media
A Georgia couple whose baby was decapacitated during childbirth was awarded a $2.25 million verdict after their pathologist posted graphic autopsy videos on social media without their consent. Dr. Jackson Gates and his Atlanta-based business will have to fork over the large sum to Jessica Ross and Traveon Taylor Sr. after a Fulton County jury found him liable of emotional distress, invasion of privacy, and fraud on Wednesday. 'This young couple trusted him with the remains of their precious baby,' attorney's for the grieving parents said, noting that the doctor 'poured salt into the couple's already deep wounds.' 3 Jessica Ross and Treveon Taylor Sr., parents of a baby who was decapitated during childbirth. AP 'Gates, in turn, repaid this trust by posting horrific images of their child for the world to see.' The heartbroken couple hired the twisted doctor to perform an autopsy on their deceased newborn two days after their obstetrician allegedly applied excessive force to the baby's neck when its shoulders became stuck in Ross's pelvic area, causing it to detach during the traumatic July 2023 delivery. 3 The traumatic delivery occurred at Southern Regional Medical Center in July 2023. ERIK S LESSER/EPA-EFE/Shutterstock The baby's head was delivered vaginally, but the rest of the body was removed via C-section. The death was later ruled a homicide. Gates posted numerous videos and photos to his Instagram later that month, showing the grisly postmortem examination of their infants 'decapitated, severed head,' the couple said in their lawsuit. The deranged pathologist initially removed the footage after receiving a letter from the couple's attorney — but later reposted them, according to the lawsuit. 3 The couple was awarded $2.25 million in a lawsuit against their pathologist. AP Gates' attorney, Ira Livant, said his client typically documents his autopsy's on social media to educate fellow pathologists and highlight the importance of independent examinations in cases where families suspect medical misconduct. 'Dr. Gates testified that he is deeply sorry for any harm that he unintentionally caused the plaintiffs,' Livant said Saturday. 'Had he known for one second that they would see that and that they would know it was their child, he would never have done it.' The couple will receive $2 million in compensatory damages and an additional $250,000 in punitive damages from Gates and his company, Medical Diagnostics Choices, per the judgement. The bereaved parents have separate lawsuits pending against the delivering doctor and the Riverdale hospital where the horrific incident took place. With Post wires.
New York Post
7 hours ago
- New York Post
Man conned out of $400K in gold coins latest vic of LI fraud ring: suit
A Michigan man was allegedly scammed out of almost $400,000 in gold coins by a Long Island dealer who is at the center of at least a dozen scams across the United States, court documents reveal. Ahmad Abdallah shipped five boxes of American Gold Eagle coins to Suffolk County-based Austin Coins in May 2024 as part of a deal that they be appraised and sent back if no trade was agreed to, according to a lawsuit filed on Long Island last week. The collection included nearly 150 perfect condition, 22-karat coins minted as early as 1987 and ranging in size from 1/10th of an ounce to 1 ounce. The coins have face values of up to $50 each, though with gold currently priced at $3,400 an ounce, their actual worth is much higher. 3 Patrick White sent Ahmad Abdallah a text in October of Abdallah's coins that were supposed to be returned after appraisal, according to a lawsuit. Obtained by the New York Post After what he says was a 'bad faith, low-ball appraisal,' Abdallah demanded that Patrick White, the owner of Austin Coins, send the collection back to him, the federal court filing claims. But Abdallah never got his coins back, he claimed in the suit, and was instead strung along by White, who assured him he was trying to find a buyer for the collection. 'Any news on my coins?' Abdallah asked White in October, according to court documents. 'Pat, please man, tell me something.' 'Pat, you just tell me things to hold me off for a day or so and then you disappear and nothing happens,' Abdallah texted him a week later. Abdallah is seeking at least $385,000 for what he calls a 'willful, fraudulent, and dishonest 'appraisal scam.'' 3 White sent Abdallah over text boasting of his travels. White was already in court in April for a hearing in a different case, in which he and co-conspirators were accused of scamming Earl Keith — an 82-year-old retiree and cancer patient from Wyoming — into 'investing' more than $300,000 of his life savings into gold coins. Kenneth Walsh, an attorney for Keith, Abdallah and several other alleged victims of White and his businesses said he asked White about Abdallah during the April hearing. White claimed he had Abdallah's coins at his home in Huntington, before admitting they were actually in a storage container mostly filled with 'junk' in Melville that was at risk of being auctioned off because he owed the facility money, according to transcripts. He paid the CubeSmart an hour before the contents were auctioned off but has refused to return Abdallah's coins, according to the court papers. 3 Abdallah begged White for months to give him an update on his gold coins and to ship them back to him in Michigan. Obtained by the New York Post 'Mr. Abduallah's case is an unfortunate example of how these coin fraudsters work,' Walsh told The Post. 'We believe there are many other Austin Lloyd customers like him suffering financial losses in the millions,' Walsh continued. 'Even while under investigation, Patrick White and his accomplices continue to brazenly defraud consumers like Mr. Abduallah. Someone has to put an end to this — and that's why we pursue these cases.' White, a former stockbroker now banned by the US Securities and Exchange Commission, is accused of being the 'ringleader' of at least 12 different coin scams, according to a lawsuit filed last year in Onondaga, New York, and several others reviewed by The Post. White allegedly swindled upwards of $6.8 million from people across the country since around 2020, primarily 'vulnerable' retirees recruited through telemarketing cold calls made by his various shell companies, including Austin Lloyd, Inc., according to the filed lawsuits. White said in court testimony that he and his accomplices had more than 5,000 customers. White, who sources say has yet to face jailtime for the accused crimes, did not immediately respond to a message from The Post.
