Wahlap data leak exposes 18.9 million records from WeChat mini-program ecosystem

Chinese arcade game maker Wahlap reportedly left a massive user database exposed online, containing 18.9 million records tied to its WeChat mini-program ecosystem. The data, which included unique Union IDs, phone numbers, and personal details, could have been exploited for targeted phishing and fraud, with further coverage provided by Tech Radar.

Security researchers from Cybernews discovered an open Elasticsearch instance belonging to Wahlap, a prominent arcade game manufacturer that collaborates with industry giants like Sega. The exposed data encompassed 6.6 million unique Union IDs, 1.7 million phone numbers, and personal information such as dates of birth and full names. This information could be used to profile Wahlap users and facilitate sophisticated phishing attacks and fraudulent activities.

Researchers found no evidence of data exfiltration and the database was secured shortly after the disclosure. The incident highlights the potential risks associated with storing sensitive user data in unsecured cloud environments.

Source: Tech Radar