Neon Mobile, an app that paid users for recording and selling their phone call data to AI firms, suffered a critical security breach exposing highly sensitive user information. The vulnerability allowed unauthorized access to phone numbers, call transcripts, audio recordings, metadata (call duration, date), and a full list of recent calls from all users—without authentication. The flaw was trivial to exploit using basic tools like Burp Suite, revealing a near-total collapse of security controls. TechCrunch confirmed that recordings included covertly captured real-world conversations, often without the knowledge or consent of all parties involved. The breach risked exposing private, identifiable discussions—ranging from personal matters to financial or professional details—with no safeguards against misuse. The app was taken offline after the discovery, but the founder’s response downplayed the severity, failing to disclose the full scope of the exposure to affected users. The incident underscores systemic failures in data protection, consent mechanisms, and secure API design, with potential long-term reputational and legal repercussions for the company.