Millions of sensitive data records exposed online due to settings fault with this top Microsoft tool

• Researchers from AppOmni found a misconfiguration bug in sites built with Microsoft Power Pages
• As a result, data on millions of people was leaking on the web
• UK NHS among affected firms, with other urged to investigate immediately

Businesses in both the private and public sector have been leaking personally identifiable information (PII) on millions of people due to a fault with a Microsoft website builder platform.

Experts from AppOmni revealed the leak stems from misconfigurations in Microsoft’s Power Pages, a low-code platform within the Microsoft Power Platform suite that allows users to build websites without needing to be expert coders.

However, due to misconfigured access controls - namely excessive permissions granted to the Anonymous role - many websites were leaking “significant amounts of data”. That information included full names, email addresses, phone numbers, and home addresses.

NHS among those affected

Power Pages is especially geared toward business users and developers ...