UStrive Data Leak Exposes Sensitive Information of 238,000 Users, Including Minors A security researcher discovered a critical flaw in UStrive, a U.S.-based online mentoring platform, that exposed the personal data of approximately 238,000 users. The vulnerability, found in the company’s Amazon-hosted GraphQL API, allowed unauthorized access to sensitive information, including full names, email addresses, phone numbers, and other user-provided details. Due to the nature of the service, many affected users were minors. The researcher, who chose to remain anonymous, identified the issue while analyzing network traffic in their browser tools and reported it to TechCrunch. After contacting UStrive, the company confirmed the leak had been "remedied" but provided no further details on how long the data was exposed, whether malicious actors accessed it, or if affected users would be notified. UStrive’s legal representative cited ongoing litigation with a former software engineer as a limiting factor in their response. The incident highlights the risks of database misconfigurations in cloud environments, which remain a leading cause of data breaches. Such leaks can result in financial losses, reputational damage, and legal consequences for affected organizations.