Vanta bug exposed customers’ data to other customers

Vanta, a compliance-focused company, has disclosed that a technical glitch led to the unintended exposure of certain customer data to other users within its platform. According to a statement provided to TechCrunch, the issue stemmed from a change in product code rather than a security breach. Vanta, which assists businesses in automating their security and compliance procedures, detected the problem on May 26, with plans for full remediation by June 4. The incident reportedly affected a limited portion—less than 20%—of data linked to third-party integrations, impacting under 4% of Vanta's clientele. Given Vanta's customer base of over 10,000, this means that potentially hundreds of customers were involved. One affected customer informed TechCrunch that they received a notification from Vanta regarding the data exposure. The notification specified that employee account data had been mistakenly integrated both into their Vanta profile and shared with other users. This data typically includes details such as employee names, their roles, and configurations related to tools like multi-factor authentication. When inquired about the specific types of data compromised, Vanta's spokesperson, Erin Cheng, refrained from providing details on the nature of the exposed customer data or confirming if any employee information was included. Established in 2018, Vanta has raised over $350 million in funding, with $150 million secured during its Series C round in July 2024.