Streaming site Kanopy exposed viewing habits of users, researcher says

On-demand video streaming site Kanopy has fixed a leaking server that exposed the detailed viewing habits of its users.

Security researcher Justin Paine discovered the leaking Elasticsearch database last week and warned Kanopy of the exposure. The server was secured two days later on March 18, a spokesperson told TechCrunch. “We are currently investigating the scope and cause as well as reviewing all of our security protocols.”

Kanopy is like Netflix but for classic movies and documentaries. The company partners with libraries and universities across the U.S. by allowing library card holders to access films for free.

In a blog post, Paine said the server contained between 25-40 million daily logs, which he said could have identified all the videos searched for and watched from a user’s IP address.

“Depending on the videos being watched — that potentially could be embarrassing information,” he wrote.

The logs also contained geographical information, timestamps, and device types, he said. He noted that there was no other personally identifiable information — such as usernames and email addresses — attached to the logs. 

According to a report last year, Kanopy has more than 30,000 movies on its platform.

Cybersecurity 101: Six simple security guides for protecting your privacy