Incident: Logged in was mistaken for allowed

Module 10 · Incident file · About 35 minutes

What happened

On 5 May 2021 Jan Masters of Pen Test Partners published "Tour de Peloton: Exposed user data". Peloton's API let "an unauthenticated user" view "sensitive information for all users". The data included user and instructor IDs, group membership, location, workout statistics, gender and age, and "whether they are in the studio or not". Several GraphQL endpoints also "allowed unauthenticated users to make GraphQL queries to access data". Profiles set to private were exposed too: on his own private account he "could still retrieve the data!"

The timeline is the instructive part. Masters reported the flaw on 20 January 2021 under Peloton's disclosure programme. On 2 February it was "silently and partly resolved": "user data was now only available to all authenticated Peloton users." After 90 days, with no reply, the researchers asked TechCrunch to contact Peloton. Zack Whittaker reported the story the same day, noting Peloton had more than three million subscribers and that anyone could sign up for a monthly membership and regain access. After the press contact, Peloton's new CISO got in touch and "the vulnerabilities were largely fixed within 7 days." Peloton told TechCrunch it had been "slow to update the researcher about our remediation efforts." Whether anyone misused the data is not known.