\n<\/p>\n
Fashion giant Express has patched its website to fix a security flaw that allowed anyone to view other people\u2019s order details and personal information, TechCrunch has exclusively learned. At least a dozen of Express\u2019 customer orders had been publicly listed in web search engine results.<\/p>\n
The security flaw exposed order confirmation pages on Express\u2019 online store, revealing details of purchases and who made them.<\/p>\n
The exposed information contained customer names, phone numbers and email addresses; postal, billing, and delivery addresses; order details, including the items that a customer purchased; and partial payment card information, including the card type and the last four-digits.<\/p>\n
Express is a large clothing retailer with hundreds of stores across the United States, Mexico and Latin America. The once-publicly listed company is now run by WHP Global, which also owns several fashion and retail giants.<\/p>\n
Rey Bango, a security and privacy advocate, accidentally discovered the flaw after investigating a fraudulent purchase on a family member\u2019s account, but found no way to report the flaw to Express. Bango asked TechCrunch to alert the company in an effort to get the bug fixed.<\/p>\n
\u201cWhen I tried to look up if the order number was a legitimately formatted Express order number using Google, I saw a link to another order and someone else\u2019s order information came up!\u201d Bango told TechCrunch.<\/p>\n
TechCrunch verified that one could tweak the order confirmation webpage address to view the order and personal information of other customers. Express uses order numbers that are largely sequential, which makes it easy to potentially cycle through thousands of orders by changing the order number in the web address using automated web tools.<\/p>\n
After we contacted Express, the apparel giant fixed the flaw on Wednesday, but would not say if it plans to notify customers of the security lapse.<\/p>\n
When reached for comment, Express\u2019 head of marketing Joe Berean told TechCrunch: \u201cWe take the security and privacy of customer information seriously and encourage anyone who identifies a potential security concern to contact us directly.\u201d<\/p>\n
\u201cUpon becoming aware of this issue, we investigated and continue to review the matter and have no further comment at this time,\u201d said Berean.<\/p>\n
Berean would not say how customers could contact the company, nor detail if the company has plans to update its website to receive reports of security flaws, such as a vulnerability disclosure program. He did not say if the company had the technical means, such as logs, to check if anyone had accessed the personal information of other customers.<\/p>\n
The executive did not respond to follow-up questions, including if Express planned to disclose the incident to state attorneys general as required by U.S. data breach notification laws.<\/p>\n
Express\u2019 security lapse is the latest incident in recent months where customers\u2019 information was left exposed to the internet due to misconfigurations or inadvertent security lapses.<\/p>\n
In December, a security researcher found that Home Depot had exposed its internal systems for a year<\/a>, but struggled to alert the company to the incident. In the same month, veterinary and pet wellness giant Petco took down its website after TechCrunch found the company\u2019s Vetco Clinics site was spilling customers\u2019 personal information<\/a> and their pets\u2019 medical documents.<\/p>\n<\/div>\n