TrueDialog database leaked online tens of millions of SMS text messages

Millions of SMS messages have been leaked by a database run by TrueDialog, a business SMS provider for businesses and higher education providers.

Security experts at vpnMentor discovered a database belonging to the US communications company, TrueDialog that was leaking millions of SMS messages. Most of the SMS included in the database were sent by businesses to potential customers. TrueDialog focuses on providing several different SMS programs including mass text messaging, marketing SMS options, urgent alerts, an Education SMS solution, and more.

The company currently works with over 990 cell phone operators and has more than 5 billion subscribers.

“Aside from private text messages, our team discovered millions of account usernames and passwords, PII data of TrueDialog users and their customers, and much more.” reads the post published by vpnMentor.

“By not securing their database properly, TrueDialog compromised the security and privacy of millions of people across the USA.”

The database was left unsecured online and data was stored in plain text, it is hosted by Microsoft Azure and it runs on the Oracle Marketing Cloud.

According to the researchers the database included 1 billion entries belonging to over 100 million US citizens, last time they analyzed the archive it included 604 GB of data.

Experts found tens of millions of entries from messages sent via TrueDialog and conversations hosted on the platform. The sensitive data contained in these SMS messages included full names of recipients, TrueDialog account holders, TrueDialog users, the content of messages, email addresses, phone numbers of recipients and users, dates and times messages were sent, status indicators on messages sent (i.e. Read receipts, replies, etc.), TrueDialog account details.

“The data exposed was a mix of TrueDialog account holders, users, and 100s of millions of American citizens.” continues the post.

The database includes logs of the platform that revealed important details as to how the database is structured and managed.

The database also includes logs of internal system errors as well as many HTTP requests and responses that expose the site’s traffic.

vpnMentor attempted to report their discovery to TrueDialog but they never received a reply. The database was discovered on 26/11/19 and experts reported it to TrueDialog on 28/11/19, the database was secured on 29/11/19.

“The impact of this data leak can have a lasting impression for hundreds of millions of users. The available information can be sold to both marketers and spammers.” concludes vpnMentor. “TrueDialod competitors could have gotten a look into their backend and seen how the company is run from within. This would have given them a way to copy, or improve upon, the business model that has brought TrueDialog success.”

Pierluigi Paganini

FAIR USE NOTICE: Under the "fair use" act, another author may make limited use of the original author's work without asking permission. Pursuant to 17 U.S. Code § 107, certain uses of copyrighted material "for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright." As a matter of policy, fair use is based on the belief that the public is entitled to freely use portions of copyrighted materials for purposes of commentary and criticism. The fair use privilege is perhaps the most significant limitation on a copyright owner's exclusive rights. Cyber Defense Media Group is a news reporting company, reporting cyber news, events, information and much more at no charge at our website Cyber Defense Magazine. All images and reporting are done exclusively under the Fair Use of the US copyright act.

Global InfoSec Awards 2022

We are in our 10th year, and these awards are incredibly well received – helping build buzz, customer awareness, sales and marketing growth opportunities, investment opportunities and so much more.

APPLY NOW