Cybersecurity firm UpGuard identified approximately 16,000 databases hosted on the Supabase platform that were publicly exposing sensitive user information. The exposed data includes names, addresses, phone numbers, and passwords, as well as authentication tokens.
The leaked information spans various sectors, including contact details from an immigration service, license plates from a U.S. valet company, and private communications from an adult streaming site. Researchers also discovered a database linked to an African government consulate in France.
UpGuard noted that one of the identified databases was utilized by a virtual SIM farm to intercept text messages and one-time passcodes for online account verification. While many of the affected datasets are located in the United States, the issue is global.
Supabase, which holds a valuation of $10 billion, has faced criticism regarding user database security. The platform's Chief Information Security Officer, Bil Harmer, stated that projects are secure by default and emphasized that security remains a shared responsibility between the company and its customers.
