Wanadooops! Flaw Reveals User Data
Users on a Wanadoo user bulletin board earlier this week reported a vulnerability in Wanadoo's account recovery system servers that lets any browser user pull down the name, user ID, password, email address, and Web space subdomain of many Wanadoo U.K. customers.
In a statement, Wanadoo confirmed that "a small number of links to files containing customer details have been posted on the Internet." The company said it has taken down the sensitive information and has alerted the customers involved to change their passwords. However, Wanadoo hasn't yet fixed the problem: "An investigation is currently taking place to uncover how this happened and ensure that this does not happen again," the statement said.
Get the bloody details of the cockup at Dark Reading.
— Tim Wilson, Site Editor, Dark Reading