Three Photo ID Apps Expose Sensitive Data of 152K Users via Misconfigured Firebase Instances Cybersecurity researchers at Cybernews uncovered three popular mobile apps leaking highly sensitive user data through exposed Firebase instances. The misconfigured databases, lacking proper authentication and access controls, exposed emails, usernames (often including full names), Firebase Cloud Messaging (FCM) tokens, profile photos, and GPS coordinates data that could enable phishing, identity theft, and even physical tracking of users’ movements. The affected apps Dog Breed Identifier Photo Cam (66,182 users exposed), Spider Identifier App by Photo (40,779 users exposed), and Insect Identifier by Photo Cam (45,005 users exposed) collectively have over 2 million downloads on Android. While not all users were impacted, those who enabled optional features tied to the misconfigured databases were at risk. Evidence suggests hackers had already accessed the data, as researchers discovered a Proof-of-Concept entry a common indicator left by automated bots scanning for unsecured databases. Despite repeated attempts, Cybernews was unable to contact the app developers for remediation. The breach highlights the risks of assuming app security based on popularity alone, as even widely downloaded applications can harbor critical vulnerabilities. The exposed GPS data, in particular, raises concerns about potential stalking or targeted attacks.