Tokee Messaging App Exposes 1.2 Million Users’ Data in Unsecured Database Security researchers at Cybernews discovered an unprotected MongoDB database belonging to Tokee, a messaging app developed by US-based software firm Deucetek, exposing sensitive data for approximately 1.2 million users. The incident, identified in recent weeks, revealed a trove of unencrypted personal information, including display names, phone numbers, profile avatars, device tokens, user IDs, account creation timestamps, activity logs, and account status flags (e.g., premium or non-premium). While chat logs stored in the same database were encrypted using password-based OpenSSL encryption mitigating immediate risks researchers warned that the exposed metadata alone posed significant privacy, security, and regulatory threats. The database was accessible to anyone with knowledge of its location, though there is no evidence it was previously accessed by malicious actors or leaked to the dark web. Tokee, which has over 1 million downloads on Android (Apple’s App Store does not disclose download figures), likely saw most of its user base affected by the breach. Following responsible disclosure, Deucetek secured the database. However, users remain at risk of phishing attacks, particularly from fraudulent messages impersonating Tokee or Deucetek. The incident underscores the potential consequences of misconfigured cloud storage in widely used applications.