OxBykes mobile app flaw grants admin acces, exposes customer information
Take action: Always validate user permissions on every single API call server-side - never trust that the mobile app or frontend is sending the right user role, and implement proper authorization checks for each endpoint. Databases should NEVER be accessible directly, only through an application layer with controls.
Learn More
OxBykes, a bicycle rental company operating in Oxford, Cambridge, and London, has experienced a significant data breach due to a security flaw in its mobile application.
The incident was discovered on May 13, 2025 and resulted in unauthorized access to sensitive customer information through an administrative-level permission error within the app's interface. A regular customer was accidentally granted administrative access to the company's database while attempting to contact customer support about a rented bicycle.
According to the customer, who has requested anonymity, this vulnerability was accessible "throughout the past week" prior to discovery. The flaw was apparently triggered by a specific button within the mobile application that inadvertently provided database access.
Upon discovering the issue, OxBykes founder Louis Wright personally contacted the customer via WhatsApp on Sunday, acknowledging the error and requesting discretion regarding the confidential information. The data breach exposed customer information, including:
- Full names
- Contact details (likely including phone numbers and email addresses)
- Order history and rental records
- Other unspecified customer database information
OxBykes CEO Tom Widgery confirmed the incident on Wednesday, stating that the company is treating the matter "with the utmost urgency." The company has implemented several response measures:
- The security vulnerability has been patched to prevent further unauthorized access
- OxBykes is consulting with legal counsel to understand the full implications of the breach
- The incident has been reported to the Information Commissioner's Office (ICO) in compliance with data protection regulations
- The company is preparing to directly contact all potentially affected customers
The number of affected individuals has not been disclosed. OxBykes has characterized the exposure as affecting "a very limited selection of customer data from a small number of customers," but no specific figures have been provided.
The company operates 42 bicycle depots across three major UK cities (25 in Oxford, 14 in Cambridge, and 3 in London), suggesting they have a substantial customer base that could potentially be affected.
