Joseph Cox writing for Motherboard:
Tesla accidentally granted a random customer control over its official forums when the customer complained about their delayed Tesla vehicle delivery. That access allowed the customer the ability to edit or delete anyone else’s posts, as well as see the contact information for the forum’s 1.5 million users.
This bizarre story starts with Dan, the CEO of travel website DansDeals.com, who recently posted on the Tesla owners’ forum about some of the delivery issues with his car. Oddly, when Dan tried to edit the post, the thread disappeared entirely, according to a blog post Dan published over the weekend. It turned out Dan didn’t have an “owners” account, and could only make one thread on the forum per day. He contacted customer support to solve the issue.
“So I called Tesla and asked the agent to please list me as an owner on the Tesla Forums,” Dan wrote. “The agent had no idea what ‘forums’ meant. I explained that they were on Tesla.com, but sure enough, there is no link on Tesla’s site to the forums. I said to type in forums.tesla.com and the agent said she would pass on my request to her IT department.”
The IT department, it seems, may have taken the request a bit too literally.
A short while later, Dan noticed he “had the ability to edit and delete everyone’s posts! Then I looked at the top of the page and noticed the admin bar. Something very strange was going on here,” his post continues.
“But this was much bigger than that. I clicked on the People option and was able to view the contact information of over 1.5 million account holders,” Dan adds. He was even able to search for particular people, and found neighbours and friends with Teslas, Dan claims. He believes he found Elon Musk’s own account, who last logged in some three and a half years ago.
“Clearly he prefers Twitter,” Dan wrote. At one point, Dan accidentally removed thousands of threads when he republished, and then unpublished, his rogue thread that had started the series of events in the first place.