Zoom found leaking personal user data owing to how it manages contacts

A hot potato: Zoom recently got out of a messy situation where its iOS app was secretly sharing data with Facebook, but now another problem has reared its head that potentially affects user privacy on all platforms because of how the software’s ‘Company Directory’ feature works.

Zoom’s sky-rocketing popularity seems to be a mixed blessing for the company, as yet another privacy issue crept up this week, involving leakage of personal information of thousands of users by exposing their email address and photo to strangers on the platform and potentially enabling the latter to initiate unwanted video calls.

The problem this time isn’t confined to Zoom’s recently fixed iOS app, but as Vice notes, is related to how the platform’s “Company Directory” setting is configured. While users who’ve signed up with the same company email domain are grouped together to make searches and calls easier with colleagues, some people who used their private email to join Zoom have had thousands of strangers added to their contacts list, all of whom Zoom perceives are working under the same organization as they have the same domain name.

A screenshot sent to Vice by an affected user reveals nearly a thousand unknown contacts added to his company directory

“If you subscribe to Zoom with a non-standard provider (I mean, not Gmail or Hotmail or Yahoo etc), then you get insight to ALL subscribed users of that provider: their full names, their mail addresses, their profile picture (if they have any) and their status. And you can video call them,” said Barend Gehrels, a Dutch user who had 995 strangers added to his contacts list after signing up with an email domain from his local ISP.

Another user experiencing the same issue notified their ISP, who couldn’t rectify it on their end and asked the complainant to contact Zoom. The company officially exempts the aforementioned public domains from a users’ Company Directory but notes that they need to submit a request for manually blacklisting non-standard domains.

Zoom also blacklisted the specific domains highlighted by Vice in their report, but it remains to be seen how widespread the issue is for the millions of new users who’ve recently hopped on the platform for conducting remote meetings, taking online classes, and keeping in touch with their families.

Masthead Credit: Dado Ruvić/Reuters