Video call app Huddle01 exposed 600K+ user logs

The Malwarebytes article reports that the video call app Huddle01 exposed over 600,000 user logs through an unprotected Kafka broker. According to Cybernews, the Kafka instance contained over 621,000 log entries from the last 13 days, including usernames, email addresses, and crypto wallet addresses, tied to real-time meeting details such as who joined calls, participants, country, time, date, and duration.

The broker operated without authentication or encryption, meaning anyone could listen in or potentially alter data, highlighting a critical misconfiguration. Huddle01 focuses on decentralised Web Real-Time Communication (WebRTC), which can reduce latency and costs when privacy is implemented correctly, but in this case privacy was not upheld.

The article notes the data could deanonymise wallets by linking crypto addresses to usernames and emails, increasing susceptibility to targeted phishing and social engineering. It also mentions that Cybernews responsibly disclosed the leak to the company, which did not respond initially and left the server exposed for a month.