AI photo and video editing apps exposed millions of users' images and KYC data
AI-based photo and video editing applications stored over 1.5 million user images and sensitive personal data including KYC information in unprotected cloud storage, exposing 8.27TB of data. The apps were subsequently removed from Google Play Store after the vulnerability was discovered by cybersecurity experts.
What happened
An AI photo and video editing app called Video AI Art Generator & Maker stored over 1.5 million user images, more than 385,000 videos, and millions of AI-generated files in an unsecured cloud storage without password protection.
The exposed data totaled 8.27TB and included personal photographs, videos, and Know Your Customer (KYC) information such as identity documents, addresses, and mobile numbers, making it accessible to anyone on the internet.
Following discovery of the leak, the app was removed from Google Play Store or delisted from search results, but millions of users had already downloaded it.
Reported impact
Millions of Android users had their personal images, videos, and sensitive KYC documentation exposed without protection, compromising their privacy and creating potential identity theft risks.
Index analysis
Cybersecurity experts discovered that when users uploaded photos or videos to the app for editing, the files were stored in unprotected online storage accessible to unauthorized parties.
The misconfiguration affected multiple apps, with at least one additional application also leaving KYC information of some users unprotected.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.