Teammate App exposed MongoDB (Research)

A researcher discovered Teammate App had an unsecured MongoDB containing nearly 3 million records — including user credentials, employee details, and confidential documents — accessible without authentication. The company later restricted access but minimized the incident and accused the researcher; evidence indicated files could be downloaded and the researcher reported the exposure to the NZ Privacy Commissioner.