- Cybernews finds that the Abceed app exposed 46 million files via misconfigured Google Cloud bucket
- The leak includes 10 TB of private audio recordings from 5 million users practicing English
- Researchers warn that voice data can fuel vishing, voice cloning and scams like virtual kidnapping
An English learning app popular in Japan has reportedly exposed sensitive data on millions of people, putting them at risk of identity theft, impersonation and other scams.
Security researchers at Cyber news recently discovered a misconfigured Google Cloud Storage bucket with more than 46 million files, most of which were private audio recordings of users practicing their English skills through the ‘Abceed’ app.
With a user base of around five million, Abceed is a well-known and popular app that partners with the likes of Paramount, Sony Pictures Entertainment, TMS Entertainment and a major textbook publisher called Sanseido. It is also reportedly endorsed by schools and major corporations, making it the best app for learning English in the country.
The article continues below
Why voice files are important
The exposed database contained nearly 10 TB of user data – mostly people practicing English and pronouncing different words. While this doesn’t sound like much of a breakup, Cyber news notes that this can be a goldmine for cybercriminals:
“Malicious actors can misuse a dataset of leaked recordings to create phishing campaigns. They can use voice cloning technologies along with vishing, impersonating the voices of colleagues, friends or family members,” the research team said. “It can also be used to create personas where ethnicity and inexperience in speaking English can become a persuasive factor for sextortion or fraud.”
The technique may be new, but we’ve already seen it in action. Security researchers have already coined the term “virtual kidnapping,” and we’ve seen reports of people paying ransoms after believing their children were abducted.
One way to defend against these attacks is to create a “safe phrase” – a password known only to your immediate family members. That way, when someone claims to have abducted your significant other, if they don’t know the secure phrase, you can be sure it’s just a scam.
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews and opinions in your feeds. Be sure to click the Follow button!
And of course you can too follow TechRadar on TikTok for news, reviews, video unboxings, and get regular updates from us on WhatsApp also.
