Unprotected MoviePass Server Exposes Tens of Thousands of Card Numbers
A critical MoviePass database left without a password exposes over 58,000 customer card numbers, personal credit card details, and mistakenly typed passwords. The company only takes the leaking server offline after TechCrunch contacts executives.
A massive unprotected database exposes tens of thousands of MoviePass customer records, including sensitive financial information. Security researcher Mossab Hussein discovers that a server on a MoviePass subdomain lacks password protection, leaving 161 million records accessible to anyone on the internet. The database grows in real time and contains entirely unencrypted data.
The exposed records include more than 58,000 MoviePass debit card numbers, which function like standard Mastercards, along with their expiration dates, balances, and activation dates. The leak also reveals customers' personal credit card numbers, billing names, and postal addresses, providing enough information for potential fraudulent purchases.
Additionally, the database logs failed login attempts, storing users' email addresses alongside incorrectly typed passwords in plain text. Hussein contacts MoviePass CEO Mitch Lowe over the weekend but receives no response, and the company only takes the database offline after TechCrunch reaches out on Tuesday.