Sprint Corp. customers are reporting that they can see information from other customers via their online accounts, a technical issue that’s exposing private personally identifiable information.

The data exposed included first and last names, cell phone numbers and prior calls that users made. One person told TechCrunch Monday that she had seen the details of 22 other Sprint customers in a two-hour period.

Sprint confirmed the data exposure, describing it as a “technical issue with Sprint.com [that] allowed a limited number of customers to view some information associated with other Sprint accounts.” The “technical issue” has been rectified, the company said.

Oscar Tovar, vulnerability verification specialist WhiteHat Security Inc., told SiliconANGLE that the glitch appears to be the result of a software bug that was not discovered before a release deployment.

“It serves as a reminder that security encompasses all stages of the software development lifecycle, including testing,” Tovar said. “In this instance, the application did not sufficiently enforce user account access controls, which in turn led to the disclosure of some user account information.”

Tovar added that enterprises can be more proactive to help prevent more scenarios like this.

“In today’s world, where agile software development has accelerated the rate of software release, it is paramount to include security testing,” he said. “Implementing a testing requirement early on will not only ensure that the application does not disclose information unknowingly, but will also ensure that other security issues are caught early on so that they can be remediated.”

Photo: jeepersmedia/Flickr