On 13 May, the website for OxBykes, a popular local bike sale and rental company experienced a serious data leak, as ‘an additional button in their mobile navigation panel’ granted a member of the public ‘administrative level access to the full bicycle and customer database (including names, phone numbers, emails, photos of student IDs, and order history)’. A user who discovered the data breach told The Oxford Blue how they were contacted by the founder of OxBykes, Louis Wright, via WhatsApp on 18 May with a request that no confidential information be shared. The message explained the data breach as the result of a ‘website overhaul’ where this client (who provided the tip-off to The Blue) was made an ‘admin of the system’. Though the company claimed that this confidential information was wrongly made available to only this one specific user, this still risks violating privacy laws, and it is unclear how such a basic error could have been made.
The Oxford Blue was contacted by the user who discovered the data leak and had concerns that OxBykes would not properly notify those affected by the breach. Since this, the BBC has published an article in which the company CEO stated that OxBykes is treating the situation with ‘utmost urgency’ and that they are ‘preparing to contact any potentially affected customers directly’. The Blue has also been shown screenshots by this user corroborating their story, though the user who discovered the data leak wished to remain anonymous.
OxBykes was founded by University of Oxford graduates who ‘hated the lack of affordable refurbished bikes in Oxford’. Screenshots provided to The Blue showed the user who contacted us regarding this story listed as an admin on the site and images of lists of previous and current users of OxBykes including their full names, phone numbers, and personal and student email addresses.
Previously, while they were still operating under the name OxBikes, The Blue profiled the company shortly after its establishment in August 2021. OxBykes was founded by three students from Trinity College, and as such is frequently used by other students in Oxford.
OxBykes has not responded to The Blue’s request for comment.