Mighty Ape website logging me in as different users

Forums › Off topic › Mighty Ape website logging me in as different users

boosacnoodle

963 posts

Ultimate Geek

#319696 22-May-2025 23:07

I just now logged into Mighty Ape and, concerningly, on every other page refresh it is logging me in as someone else. It's given me several different user accounts.

Not only is it concerning that I could potentially place an order on their account, but I can see their credit card details, home addresses, emails and full order history.

1 | 2 | 3 | 4 | 5

BDFL - Memuneh
79263 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#3375803 22-May-2025 23:15

Not good. Contacted them yet?

michaelmurfy

meow
13242 posts

Uber Geek

Moderator

ID Verified

Trusted

Lifetime subscriber

#3375804 22-May-2025 23:22

I just verified this.

I never use Mightyape so wasn’t logged in, however I was. I could see everything including name, address and there was a credit card linked. There was nothing stopping me from potentially placing an order.

This is bad… I’ve tried a few email addresses now to let them know but just get bounce backs. Appears to be somewhat resolved now.

Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup)

Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.

michaelmurfy

meow
13242 posts

Uber Geek

Moderator

ID Verified

Trusted

Lifetime subscriber

#3375807 23-May-2025 01:43

And just now I got an email from somebody random who was logged into my account and also provided me screenshots of my account showing personal information. I went ahead and treated this account as compromised, changed my password and logged out hopefully invalidating all session cookies. We’ve both raised a case with Mightyape and I’ll contact CERT.

Same thing applied with him - he was fully logged into my account and could see anything along with potentially place orders.

rscole86

4973 posts

Uber Geek

Moderator

Trusted

Lifetime subscriber

#3375808 23-May-2025 06:10

Tried my two accounts, no problem at 530 this morning.

Qazzy03

478 posts

Ultimate Geek

#3375810 23-May-2025 06:35

I just logged into my account, and it was successful.

I did remove my saved payment information information though.

xpd

Geek @ Coastguard NZ
13765 posts

Uber Geek

Retired Mod

ID Verified

Trusted

Lifetime subscriber

#3375865 23-May-2025 08:20

Wow.... be highly surprised if they publicly admit it within the next 24hrs.

Gavin / xpd / FastRaccoon / Geek of Coastguard New Zealand

LinkTree

networkn

Networkn
32350 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#3375872 23-May-2025 08:41

xpd:

Wow.... be highly surprised if they publicly admit it within the next 24hrs.

I'd expect them not to, until they complete an investigation into what is wrong, what caused it, and what data has been accessed so they can actually make a disclosure.

Their website redesign has been a pretty sad tale of woe.

Quite a shame as they were actually doing pretty well prior to that, I thought things were actually on par or slightly better than before Kogan bought Mighty Ape.

Lenovo

Shop now for Lenovo laptops and other devices (affiliate link).

Mrcutiepatootie

47 posts

Geek

ID Verified

#3375874 23-May-2025 08:46

We knew the mighty have fallen for quite some time now.. oh it's still falling?

Just falsified info on my mighty account. It also doesn't help when changing the email address, they send out the email verification to the current one saying "Your Mighty Ape email address has just been changed to [current email address]." instead of showing what email address it's being changed to.

freitasm

BDFL - Memuneh
79263 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#3375875 23-May-2025 08:49

And this, people, is why I never click the "Save the credit card info for faster checkout next time" on any service.

freitasm

BDFL - Memuneh
79263 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#3375878 23-May-2025 09:02

I reached out to someone at Mighty Ape. I explained how this happens to some people when logged in, but it's unknown how many people have their information leaked.

I pointed out to this thread and mentioned your case specifically @michaelmurfy, based on the details you passed (email).

This is being investigated.

Jizah

236 posts

Master Geek

#3375879 23-May-2025 09:04

freitasm:

And this, people, is why I never click the "Save the credit card info for faster checkout next time" on any service.

This still won't stop me. It might if I used a Debit Plus.

michaelmurfy

meow
13242 posts

Uber Geek

Moderator

ID Verified

Trusted

Lifetime subscriber

#3375882 23-May-2025 09:10

I've also notified CERT NZ (despite it being a privacy issue) along with the Privacy Commissioner as I've got verification my own account was compromised in this incident. Yet to hear back from Mightyape.

RockCartel

17 posts

Geek

#3375885 23-May-2025 09:17

freitasm:

And this, people, is why I never click the "Save the credit card info for faster checkout next time" on any service.

This 100% , it's not worth the minor convenience.

freitasm

BDFL - Memuneh
79263 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#3375888 23-May-2025 09:24

RockCartel:

freitasm:

And this, people, is why I never click the "Save the credit card info for faster checkout next time" on any service.

This 100% , it's not worth the minor convenience.

Look, I might be wrong and something happens tomorrow. But I have had credit cards since 1989 and never had to cancel or change a number.

I know some people who cancel cards every quarter because there's always a "strange transaction". This causes a lot of problems when they have energy, broadband, mobile and other services on auto-payment from credit cards. Not even thinking of the actual possibility of fraudulent transactions.

No joke. Really.

heavenlywild

5060 posts

Uber Geek

Trusted

#3375990 23-May-2025 13:53

In the news now:

https://www.stuff.co.nz/nz-news/360699792/mighty-ape-glitch-allegedly-let-users-log-strangers-accounts-see-credit-card-info

1 | 2 | 3 | 4 | 5