- Cybernews finds Abceed app exposed 46 million files via misconfigured Google Cloud bucket
- Leak includes 10TB of private audio recordings of 5 million English-speaking users
- Researchers warn that voice data could fuel vishing, voice cloning and scams like virtual kidnappings.
A popular English learning app in Japan has reportedly exposed sensitive data on millions of people, putting them at risk of identity theft, impersonation and other forms of fraud.
Security researchers at Cybernews recently discovered a misconfigured Google Cloud Storage bucket containing more than 46 million files, most of which were private audio recordings of users practicing their English skills through the “Abceed” app.
With a user base of around five million, Abceed is a well-known and popular app, partnered with Paramount, Sony Pictures Entertainment, TMS Entertainment, and a major textbook publisher called Sanseido. It would also be trusted by schools and large businesses, making it the go-to app for learning English in the country.
Article continues below
Why voice files are important
The exposed database contained almost 10TB of user data – mostly people practicing English and pronouncing different words. Although this doesn’t really seem like a violation, Cybernews notes that this could be a goldmine for cybercriminals:
“Malicious actors could leverage a dataset of leaked recordings to create phishing campaigns. They may use voice cloning technologies with vishing, imitating the voices of colleagues, friends, or family members,” the research team said. “This can also be used to create characters where ethnicity and inexperience with English can become a compelling factor for sextortion or ‘pig butchery’ scams.”
The technique may be new, but we’ve seen it in action before. Security researchers have already coined the term “virtual kidnapping,” and we’ve seen reports of people paying ransom demands after thinking their children had been kidnapped.
One way to defend against these attacks is to create a “passphrase”: a password that only your closest family members know. This way, when someone claims to have kidnapped your partner, if they don’t know the security phrase, you can be safe in knowing that it’s just a scam.
The best antivirus for every budget
Follow TechRadar on Google News And add us as your favorite source to get our news, reviews and expert opinions in your feeds. Make sure to click the Follow button!
And of course you can too follow TechRadar on TikTok for news, reviews, unboxings in video form and receive regular updates from us on WhatsApp Also.
