Microsoft Power Apps Snafu Exposes 38M Records

The more than a thousand affected companies include big names like American Airlines and Ford.

Microsoft’s Power Apps portal service is a backend platform that helps third parties create web or mobile apps. More than a thousand of those apps have been found to be exposing the data of their users, for a combined total of around 38 million records.

Exposed data includes phone numbers, home addresses, social security numbers, and COVID-19 vaccination statuses, from a range of sources including employee databases, job application indexes, and contact tracing platforms.

It’s certainly far from the biggest data exposure in recent months, but this is a high-profile one, with affected companies including big names like American Airlines, Ford, and the New York City Municipal Transportation Authority.

How Did It Happen?

A Power Apps portal essentially helps an organization launch a quick pre-fab web application that can handle user sign-ups and maintain a database of information. In the world of website design, that’s one of the pricier types of sites. Particularly since the COVID-19 pandemic began around March 2020, these web apps have been in high demand.

In May 2021, Wired magazine reports, researchers at the security firm UpGuard spotted a number of Microsoft Power Apps portals that were exposing data that should have stayed private — one core API would expose data by default, and most customers weren’t manually correcting this in order to keep their database private. The portal design has since been tweaked to fix the issue.

“It Was Wild”

There’s no evidence that any bad actors noticed and took advantage by stealing it, but it’s not a great look for a service with as much brand authority as Microsoft. It even surprised the researchers who uncovered the problem:

“We found one of these that was misconfigured to expose data and we thought, we’ve never heard of this, is this a one-off thing or is this a systemic issue?” Greg Pollock, UpGuard’s vice president of cyber research, told Wired. “Because of the way the Power Apps portals product works, it’s very easy to quickly do a survey. And we discovered there are tons of these exposed. It was wild.”

There are a few takeaways here. First, some of the issue may be chalked up to the rapid growth of online infrastructure due to 2020’s sudden shift to remote work.

More importantly, though, it’s a reminder that the buck stops with cloud providers when it comes to making their default as secure as possible: Sure, the Power Apps customers could have tweaked the default API, but they shouldn’t be expected to.

Perhaps the biggest takeaway of all, however, is that even the biggest names in internet services won’t keep your data safe all the time. And as great as a password manager or a VPN is, this is one case in which your social security number is out of your hands. But, uh, happy Monday!

Did you find this article helpful? Click on one of the following buttons
We're so happy you liked! Get more delivered to your inbox just like it.

We're sorry this article didn't help you today – we welcome feedback, so if there's any way you feel we could improve our content, please email us at

Written by:
Adam is a writer at and has worked as a tech writer, blogger and copy editor for more than a decade. He was a Forbes Contributor on the publishing industry, for which he was named a Digital Book World 2018 award finalist. His work has appeared in publications including Popular Mechanics and IDG Connect, and his art history book on 1970s sci-fi, 'Worlds Beyond Time,' is out from Abrams Books in July 2023. In the meantime, he's hunting down the latest news on VPNs, POS systems, and the future of tech.
Explore More See all news
Back to top
close Thinking about your online privacy? NordVPN is's top-rated VPN service See Deals