Urban Massage, a popular massage startup that bills itself as providing “wellness that comes to you,” has leaked its entire customer database.
The London, U.K.-based startup — now known as just Urban — left its Google-hosted ElasticSearch database online without a password, allowing anyone to read hundreds of thousands of customer and staff records. Anyone who knew where to look could access, edit or delete the database.