OxBykes

OxBykes, a bicycle rental company operating in Oxford, Cambridge, and London, accidentally exposed customer data including names, contact details, and order history due to a security flaw in its mobile app. The data was accessible for a week, and the company is taking urgent steps to resolve the issue and contact affected customers.

Source: https://www.bbc.com/news/articles/c9q0xww2n3qo

TPRM report: https://scoringcyber.rankiteo.com/company/oxbykes

"id": "oxb313052325",
"linkid": "oxbykes",
"type": "Breach",
"date": "5/2025",
"severity": "85",
"impact": "",
"explanation": "Attack with significant impact with customers data leaks: Attack which causes leak of personal information of customers ( only if no ransomware )"

{'affected_entities': [{'customers_affected': None,
                        'industry': 'Transportation',
                        'location': ['Oxford', 'Cambridge', 'London'],
                        'name': 'OxBykes',
                        'size': None,
                        'type': 'Bicycle Rental Company'}],
 'attack_vector': 'Mobile App Vulnerability',
 'data_breach': {'personally_identifiable_information': True,
                 'type_of_data_compromised': ['Names',
                                              'Contact Details',
                                              'Order History']},
 'date_detected': '2023-05-13',
 'description': 'A bicycle rental company, OxBykes, accidentally made customer '
                'data available on its mobile app, including names, contact '
                'details, and order history.',
 'impact': {'data_compromised': ['Names', 'Contact Details', 'Order History'],
            'systems_affected': 'Mobile App'},
 'initial_access_broker': {'entry_point': 'Mobile App'},
 'investigation_status': 'Ongoing',
 'post_incident_analysis': {'corrective_actions': 'Patching the security flaw',
                            'root_causes': 'Mobile app vulnerability'},
 'references': [{'date_accessed': None, 'source': 'BBC', 'url': None}],
 'regulatory_compliance': {'regulatory_notifications': ['Information '
                                                        "Commissioner's "
                                                        'Office']},
 'response': {'communication_strategy': 'Personal communication by CEO',
              'containment_measures': 'Patching the security flaw',
              'remediation_measures': 'Contacting potentially affected '
                                      'customers'},
 'title': 'Bike Hire Data Leak',
 'type': 'Data Leak',
 'vulnerability_exploited': 'Unauthorized administrative access'}