Warning: Popular Apps Leaking Your Private Data

Researchers at Jamf Threat Labs have uncovered two mobile apps leaking sensitive user data, including credentials and PII, from a Malaysian healthcare management platform and an Indian jewellery company, both failing to respond to responsible disclosure attempts. The underlying issue, according to Jamf, is that these apps leak data over unencrypted HTTP requests while users are logging in, meaning credentials in clear form are sent to organisations’ servers unencrypted and exposed on the same network.

The first case involves Khazana Jewellery in India, whose iOS app managing savings schemes for jewellery purchases was found leaking multiple types of information, including user email, password, full name and phone number, alongside extensive personal data such as address, PAN number and ID number.

The second case concerns MiCare HealthTech Holdings, a Malaysian health‑care management company serving 15 million users, where the legacy HBC-MED app leaks usernames, passwords, national IDs, subscribed policies and Android device specifications. Jamf notes that MiCare’s newer app does not suffer from the same flaws, but the legacy app remains a risk to users who still install it, underscoring how sensitive healthcare and financial data exposures can arise in public‑facing mobile software.