Thousands of accounts affected by Zapptales security breach

The problem apparently persisted for more than a year. However, the startup said the vulnerability was never exploited.

A security vulnerability existed at the start-up Zapptales for over a year. According to information from the Spiegel's chat histories, media from the chats, the PDFs of the chat books as well as email addresses and addresses of around 69,000 customers were affected. Two hours after the report, the company blocked access to the data and released a new version the next day. However, the vulnerability was never exploited, Zapptales said.

Group Zerforschung discovered the vulnerability and reported it to the German Federal Office for Information Security and the Bavarian data protection supervisory authority. The app's developers had included the access keys to the databases where chat histories, media and customer data are stored in the source code. Hackers could have gained access to the data this way.

Zapptales converts chat histories from WhatsApp, Facebook Messenger, Instagram, Telegram, iMessage and Threema into bound books. Voice messages and videos can be played via a QR code printed in the book. The start-up was founded in 2015 by Anna Kimmerle-Hürlimann and Daniel Vicen Renner.