Ualabee Mobility Platform Exposes 472,296 User Records
What Happened – In May 2025 the South‑American mobility‑services platform Ualabee allowed an unauthenticated scraper to pull data from a public‑facing interface. The scrape harvested 472,296 unique records containing email addresses, names, dates of birth, phone numbers and profile photos.
Why It Matters for Trust & Control Assurance
- This incident illustrates a gap in access control and API‑level authorization that continuous‑control programs are built to detect and remediate.
- Without verifiable evidence that only authorized identities can query personal‑data endpoints, organizations cannot demonstrate a defensible audit trail to regulators or partners.
- Ongoing monitoring of access logs and automated policy enforcement are essential to prove due‑diligence and maintain trust.
Who Is Affected – Ride‑hailing and mobility‑as‑a‑service providers; their customers in the consumer‑facing mobility sector.
Recommended Actions
- Conduct an immediate review of all public APIs and UI endpoints for authentication and least‑privilege enforcement.
- Deploy continuous access‑control monitoring to capture and alert on anomalous data‑exfiltration patterns.
- Update incident‑response playbooks to include evidence‑preservation steps for API‑level breaches.
Source: Have I Been Pwned – Ualabee breach
Technical Notes – The data was scraped via an unauthenticated HTTP request to a user‑profile endpoint; no CVE is associated. Exposed fields: email, full name, date of birth, phone number, profile photo. Source: same as above