A UK-based researcher discovered a security flaw that allowed unauthorized access to contracts for Verizon Wireless customers which contained full names, addresses, phone numbers, model and serial number of the device, and the customer’s signature.

While authentication was needed to access the files, the expert was able to take advantage of an insecure direct object reference (IDOR) vulnerability and determine that approximately 2 million contracts were affected by the flaw. The findings were reported to Verizon in mid-June, who confirmed the findings and issued a subsequent patch a month later. The company stated, “We have no reason to believe that any customer information was accessed by anyone other than the security researcher who reported it.”

<