IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Peloton security bug could expose user data

Exposed API could let hackers access customer data

Peloton bike's wheels with a person's feet on the pedals

A flaw in how Peloton fitness bikes communicate with the company’s servers could have inadvertently allowed anyone to access customers’ private data.

According to investigations carried out by Pen Test Partners, the mobile, web application, and back-end APIs had several endpoints that revealed users’ information to authenticated and unauthenticated users.

Jan Masters, a security researcher at Pen Test Partners, spotted the vulnerability in January. He discovered he could make unauthenticated requests to the fitness firm’s API for account data. According to Masters, there were no checks to ensure he was allowed to request the data.

The exposed API allowed the researcher to access a range of information, such as a user’s age, gender, location, weight, workout stats, and birthday, even when a user makes their profile page private.

Master notified Peloton of his findings via its vulnerability disclosure program in the middle of January with a 90-day deadline to fix the issues. That deadline came and went with Peloton only acknowledging the problem and not fixing it.

In early February, Peloton quietly and partly resolved the unauthenticated API endpoint issue. Still, Masters pointed out this meant user data was now only available to all authenticated Peloton users who had taken out a monthly subscription to the service.

Related Resource

Cost of a data breach report 2020

Find out what factors help mitigate breach costs

cost of a data breach report 2020 - whitepaper from IBMDownload now

Master then asked for an update, given that Peloton had made a partial fix, but Peloton didn’t respond.

After 90 days, Master contacted a journalist at TechCrunch, who then broke the story. “This started a constructive conversation and resulted in the vulnerabilities being largely resolved,” said Masters.

“A full investigation should be conducted by Peloton to improve their security, especially now that famous individuals are openly using this service,” added Masters.

Since contacting the press, Peloton’s new CISO has remained in contact with him over the flaws. The company fixed most of them in a week.

“It’s a shame that our disclosure wasn’t responded to in a timely manner and also a shame that we had to involve a journalist in order to get listened to,” he added.

The Peloton bike has gained popularity over the years to keep fit at home, especially since the coronavirus pandemic hit the world last year. Earlier this year, President Biden was prevented from bringing his Peloton into the White House over concerns that it could be a security risk. It seems now that those concerns were well-founded.

Featured Resources

Join the 90% of enterprises accelerating to the cloud

Business transformation through digital modernisation

Free Download

Delivering on demand: Momentum builds toward flexible IT

A modern digital workplace strategy

Free download

Modernise the workforce experience

Actionable insights and an optimised experience for both IT and end users

Free Download

The digital workplace roadmap

A leader's guide to strategy and success

Free Download

Recommended

Modernise your legacy databases in the cloud
Whitepaper

Modernise your legacy databases in the cloud

10 Jun 2022
Deploying flexible data protection to support cloud workload placement
Whitepaper

Deploying flexible data protection to support cloud workload placement

10 Mar 2022
Ten ways to protect your company from the next big data breach
data breaches

Ten ways to protect your company from the next big data breach

18 Feb 2022
Europol ordered to delete huge cache of unlawfully stored data
data protection

Europol ordered to delete huge cache of unlawfully stored data

11 Jan 2022

Most Popular

Raspberry Pi launches next-gen Pico W microcontroller with networking support
Hardware

Raspberry Pi launches next-gen Pico W microcontroller with networking support

1 Jul 2022
Universities are fighting a cyber security war on multiple fronts
cyber security

Universities are fighting a cyber security war on multiple fronts

4 Jul 2022
Hackers claim to steal personal data of over a billion people in China
data breaches

Hackers claim to steal personal data of over a billion people in China

4 Jul 2022