Unsecured MongoDB Exposes 20.5 M ai.type Keyboard Users' Personal Data
What Happened — In December 2017 the virtual‑keyboard app ai.type left a 577 GB MongoDB instance exposed to the Internet. Researchers from The Kromtech Security Center discovered that the database contained over 20 million unique records, including email addresses, phone numbers, device identifiers (IMEI, IMSI), IP addresses, birth dates, social‑media profiles and more. The breach was later added to Have I Been Pwned so affected users could check their exposure.
Why It Matters for Trust & Control Assurance
- The incident is a textbook example of a configuration‑management control gap: an unsecured data store created a direct path for data exfiltration. Continuous control‑assurance programs require evidence that storage assets are hardened, monitored, and regularly audited.
- Mapping this failure to a single control objective—Secure Configuration & Access Controls—provides evidence that satisfies multiple frameworks (e.g., NIST CSF, ISO 27001) simultaneously.
- Verisq’s Control Mapping capability can automatically collect configuration evidence, flag mis‑configurations, and generate a defensible audit trail to demonstrate ongoing compliance.
Who Is Affected – Consumers of the ai.type mobile keyboard (primarily Android/iOS users) and any organizations that allowed the app on corporate devices.
Recommended Actions
- Inventory all database and storage services; verify that each is protected by authentication and network segmentation.
- Apply encryption at rest and in transit for any personal data stores.
- Enable continuous monitoring and automated evidence collection for configuration compliance; map findings to the relevant control objective in your Trust Center.
- Conduct a post‑incident audit and update incident‑response playbooks to include mis‑configuration detection.
Source: Have I Been Pwned – ai.type breach
Technical Notes – The exposure resulted from a misconfiguration of a MongoDB instance (no authentication, publicly reachable port). No known vulnerability (CVE) was exploited; the data was simply readable by anyone on the Internet. Exposed data types include email addresses, phone numbers, device identifiers (IMEI/IMSI), IP addresses, birth dates, names, gender, geographic location, installed apps, cellular network names, profile photos and social‑media links.
Source: Kromtech Security Center report