I'm not sure if this is the right community to be posting this in, please point me in the right direction if not.

I recently discovered that my cell service provider (an MVNO) has an unauthenticated API that returns (among other things) my credit card information (name, number, expiration date, address, CVV), hashed passwords and account numbers, and my phone's ESN number. Something like this:

Request

curl --data "phone=1234567890" https://example.com/api/getdata

Response

Please note: I've stripped out a lot of data and renamed the keys. There were a bunch more fields that didn't seem very important.

"account": {
  "phoneNumber": "1234567890",
  "ESN": "1111111111111111111",
  "startDate": "01/01/2010 00:00:00",
  "payment": {
    "card": "1111111111111111",
    "CVV": "111",
    "name": "My Name",
    "expMonth": "01",
    "expYear": "2021",
    "street": "111 Example Street",
    "zip": "11111"
  },
  "accountNumber": 11111111,
  "balanceEndDate": "01/01/2020 00:00:00",
  "balance": 0,
  "status": "Active",
  "planId": 00000,
  "password": "<what looks like a salted MD5 hash.>"
}

That is enough data to do a lot of damage. Besides using the card, they can port my number to a different carrier and use 2-factor authentication to reset passwords to a lot of my most security related accounts (think bank).

I discovered this the other day by using their website. They have a "Refill" option that takes your phone number and tells you your balance and lets you refill. When I realized they were telling my the balance without signing in, I opened the developer tools to look at the ajax response. To my surprise (and horror), I saw my credit card information.

#What to do?#

I'm not sure who I should report this to other than Visa/MasterCard. Are there any government/industry groups that would be interested? I'm in the US.

I'm not sure if this is the right community to be posting this in, please point me in the right direction if not.

I recently discovered that my cell service provider (an MVNO) has an unauthenticated API that returns (among other things) my credit card information (name, number, expiration date, address, CVV), hashed passwords and account numbers, and my phone's ESN number. Something like this:

Request

curl --data "phone=1234567890" https://example.com/api/getdata

Response

Please note: I've stripped out a lot of data and renamed the keys. There were a bunch more fields that didn't seem very important.

"account": {
  "phoneNumber": "1234567890",
  "ESN": "1111111111111111111",
  "startDate": "01/01/2010 00:00:00",
  "payment": {
    "card": "1111111111111111",
    "CVV": "111",
    "name": "My Name",
    "expMonth": "01",
    "expYear": "2021",
    "street": "111 Example Street",
    "zip": "11111"
  },
  "accountNumber": 11111111,
  "balanceEndDate": "01/01/2020 00:00:00",
  "balance": 0,
  "status": "Active",
  "planId": 00000,
  "password": "<what looks like a salted MD5 hash.>"
}

That is enough data to do a lot of damage. Besides using the card, they can port my number to a different carrier and use 2-factor authentication to reset passwords to a lot of my most security related accounts (think bank).

I discovered this the other day by using their website. They have a "Refill" option that takes your phone number and tells you your balance and lets you refill. When I realized they were telling my the balance without signing in, I opened the developer tools to look at the ajax response. To my surprise (and horror), I saw my credit card information.

What to do?

I'm not sure who I should report this to other than Visa/MasterCard. Are there any government/industry groups that would be interested? I'm in the US.