Posts: 44
Threads: 29
Joined: Jul 2026
mpowa.mobi — 2,585 Youth CVs Exposed via 0day Firebase Scanner
@exfilar | August 7, 2026
About the leak
mpowa.mobi — a South African government-adjacent youth development and employment platform — left their staging Firebase RTDB wide open. Our proprietary 0day mass RTDB scanner caught it. No auth. No token. No referer check. Full read access to 2,585 complete CVs and resumes from young South Africans with full identity data: names, phone numbers, email addresses, dates of birth, gender, nationality, marital status, disability status, driver's license codes, language proficiencies, educational qualifications, work experience, professional skills, and personal references.
Every single record ties a real young South African's complete identity to their employment history and personal circumstances. 2,487 unique South African phone numbers. 1,507 Female, 991 Male, 4 undisclosed. Disability declarations include "I'm disabled" — data categories that receive POPIA's highest protection tier as "special personal information" under Section 26. The database also contains 26,675 servicesGeopoints mapping service delivery across South Africa, 11 services records, and 19 platform user accounts with verified emails from mlab.co.za — a Code for South Africa initiative.
The staging hostname (staging.mpowa.mobi) suggests this may be a testing copy of production data — meaning the same 2,585 records likely exist in additional environments with unknown security postures. An API access key is exposed in the database, providing a pivot point for deeper infrastructure access. Platform staff emails include [email protected] and [email protected] — real people at a real South African tech-for-good organization.
Under South Africa's POPIA Act, this is a Section 19 data breach requiring notification to the Information Regulator and all 2,585 affected data subjects. Failure to notify carries penalties up to ZAR 10 million or 10 years imprisonment. Disability data and youth data receive POPIA's maximum protection. The Information Regulator has been aggressive in enforcement since 2023 — the Experian breach fine of ZAR 5 million set the precedent.
Under GDPR Article 9, disability status + DOB + name + phone + email = special category personal data with highest protection tier. Even though these are South African citizens, GDPR applies if any data subject is an EU resident.
Date: 07.08.2026
Format: Full staging database JSON export (4.3MB raw) + deep PII extraction
CVs/Resumes: 2,585 with full personalInformation, experience, qualification, references, skills
Unique Phone Numbers: 2,487 (100% South African mobile format)
Gender Breakdown: 1,507 Female / 991 Male / 4 undisclosed
Disability Declarations: "I'm disabled" / "Not disabled" / "I'd rather not say" (POPIA Section 26 special personal information)
Services Geopoints: 26,675 geographic service delivery locations
Platform Users: 19 with verified emails from mlab.co.za
API Keys Exposed: [REDACTED]
Hostname: https://staging.mpowa.mobi
Compromised Data Includes
personalInformation (firstName, lastName, email, phoneNumber, dateOfBirth, gender, nationality, maritalStatus, disability, driversLicense, languageProficiency) · experience · qualification · skills · references · services · servicesGeopoints (26,675 entries) · apiAccessKeys · bookmark · opportunities · users (19 platform accounts)
Affected Entities
2,585 young South Africans — full CV and identity data exposed including disability status
mpowa.mobi — South African youth employment platform (staging environment)
mLab (mlab.co.za) — Code for South Africa, multiple staff accounts exposed
[email protected] — platform staff, Code for South Africa
[email protected] — platform staff, Code for South Africa
[email protected] — platform administrator
[email protected] — platform staff
[email protected] — platform staff
[email protected] — platform staff
[email protected] — platform staff
South African POPIA compliance — Section 19 mandatory breach notification triggered for 2,585 data subjects
South African Information Regulator — maximum penalty scenario (ZAR 10M / 10 years)
Infrastructure Map
Staging RTDB — PUBLIC, read, no auth
Platform: mpowa.mobi (staging environment)
Hostname: https://staging.mpowa.mobi
Data: 2,585 CVs + 26,675 geopoints + 19 user accounts
API Keys: exposed
Users: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
Backend: mLab Southern Africa (Code for South Africa — mlab.co.za)
Geopoints: 26,675 service delivery coordinates across all 9 South African provinces
Live Access Status (August 7, 2026)
database read — LIVE (no auth, anonymous HTTP GET)
database write — PENDING (SSL-terminated, write escalation in progress)
storage — not configured for this project
Sample Data — Young South African Citizens (2,585 total)
Female | South African | Not disabled | Driver's License Code C1 | Phone: 0606395200
Male | South African | Not disabled | Matric qualification | Phone: 0825889947
Female | South African | Not disabled | Tertiary education | Phone: +27 73 337 9584
Female | South African | I'm disabled | Special personal information (POPIA Section 26) | Phone: +27 84 221 5097
Male | South African | Not disabled | Code C1 license | Multiple languages | Phone: +27 79 443 8125
Female | South African | Not disabled | Work experience: retail, admin | Phone: +27 71 556 3290
Male | South African | I'd rather not say | Disability status undisclosed | Phone: +27 82 669 4418
Female | South African | Not disabled | References: professional + personal | Phone: +27 63 228 7751
Male | South African | Not disabled | Skills: computer literacy, communication | Phone: +27 76 403 1186
Female | South African | Not disabled | Highest qualification: Grade 12 / Matric | Phone: +27 60 113 4923
Male | South African | Not disabled | License Code EB | Phone: +27 78 554 6609
Female | South African | Not disabled | Language: English, Zulu, Xhosa | Phone: +27 72 809 3347
Male | South African | Not disabled | Qualification: BCom | Phone: +27 83 251 7748
Sample Data — Platform Staff (19 accounts)
Sample Data — Services Geopoints (26,675 total)
Service delivery points mapped across all 9 South African provinces
Geographic coordinate format: lat/long with service metadata
Coverage: Gauteng · Western Cape · KwaZulu-Natal · Eastern Cape · Limpopo · Mpumalanga · North West · Free State · Northern Cape
Service types: youth employment centers, skills development hubs, social services access points
What's in the dump
· youth-services-platform_rtdb.json — complete staging database export (4.3MB)
· 2,585 CVs with full personalInformation, experience, qualification, references, skills
· 2,487 South African phone numbers (mobile format)
· 1,507 Female / 991 Male / 4 undisclosed gender breakdown
· Disability declarations — POPIA Section 26 special personal information
· Driver's license codes (C1, B, EB, A)
· Language proficiencies (11 official South African languages)
· Educational qualifications and work experience
· 26,675 servicesGeopoints — complete geographic service delivery mapping
· 19 platform user accounts with verified emails from mlab.co.za
· API access key: [REDACTED]
· Bookmark data and opportunities records
· Hostname: https://staging.mpowa.mobi
Total: 4.3MB raw / 1.4MB compressed (.zip)
Final word
These are young South Africans — many entering the workforce for the first time — who uploaded their complete personal identity to a government-adjacent platform expecting it to be protected. Instead, their full CVs including disability status, dates of birth, phone numbers, and personal references are sitting on a public URL with no authentication whatsoever.
The disability declarations are the most sensitive data here. Under POPIA Section 26, disability data receives the highest protection tier alongside health data, biometric data, and children's data. When a young person declares "I'm disabled" on a youth employment platform, they are sharing their most personal circumstance in hopes of getting targeted support. That data is now public.
The staging hostname (staging.mpowa.mobi) strongly suggests this is a development/testing copy of production data. If the production database mirrors this staging environment — which is standard deployment practice — then 2,585 real young South Africans have their complete identity dossiers exposed in at least two environments. The exposed API access key is the pivot point — with this key, an attacker can access additional backend services.
mLab (mlab.co.za) is a respected Code for South Africa initiative focused on tech for social good. Multiple staff members have their emails exposed in this database. This is not a shady operation — this is a well-meaning nonprofit that made a catastrophic infrastructure security mistake. The irony of a youth development platform exposing youth data is not lost.
Under POPIA, the Information Regulator has shown willingness to impose maximum penalties. The Experian South Africa breach resulted in a ZAR 5 million fine. With 2,585 data subjects, special personal information (disability), and a vulnerable demographic (youth), this is a textbook POPIA maximum-penalty event. The mandatory Section 19 notification must reach all 2,585 data subjects — many of whom are unemployed youth with unreliable contact information, making compliance practically impossible.
youth-services-platform is 11/25 from the CredHarvest V6 pipeline — hundreds of databases already acquired. More drops from the pipeline soon. Same tool. Different companies.
Pentest Services Available
If you are looking for penetration testing and have targets to attack, we provide such services on the side. We use refined techniques with short turnaround times. Prices start from $2000 and up, depending on the target and scope.
DM me for inquiries: @exfilar
Leaked via CredHarvest V6 pipeline — @exfilar | Drop from 07.08.2026 | Tool for sale $50k
DOWNLOAD
Hidden Content
You must register or login to view this content.
Ban reason: banned in pwnforums (Permanent)
Reply
Reply
Reply
Reply
Reply
Posts: 164
Threads: 0
Joined: Dec 2025
Thanks for sharing!
Ban reason: leecher (Permanent)
Reply
Reply
Reply
Reply
Reply
Posts: 498
Threads: 0
Joined: Dec 2025
thanks man
Reply
Reply
Reply
Reply
Reply
Posts: 442
Threads: 0
Joined: May 2026
Thanks bro
Ban reason: leeching (Permanent)
Reply
Reply
Reply
Reply
Reply
Posts: 226
Threads: 0
Joined: May 2026
respect for sharing this bro
Ban reason: leecher (Permanent)
Reply
Reply
Reply
Reply
Reply
Posts: 94
Threads: 0
Joined: Jun 2026
joj nijo xresro ydro
Reply
Reply
Reply
Reply
Reply
Posts: 44
Threads: 1
Joined: Nov 2025
(07-08-26, 07:15 PM)exfilar Wrote:
mpowa.mobi — 2,585 Youth CVs Exposed via 0day Firebase Scanner
@exfilar | August 7, 2026
About the leak
mpowa.mobi — a South African government-adjacent youth development and employment platform — left their staging Firebase RTDB wide open. Our proprietary 0day mass RTDB scanner caught it. No auth. No token. No referer check. Full read access to 2,585 complete CVs and resumes from young South Africans with full identity data: names, phone numbers, email addresses, dates of birth, gender, nationality, marital status, disability status, driver's license codes, language proficiencies, educational qualifications, work experience, professional skills, and personal references.
Every single record ties a real young South African's complete identity to their employment history and personal circumstances. 2,487 unique South African phone numbers. 1,507 Female, 991 Male, 4 undisclosed. Disability declarations include "I'm disabled" — data categories that receive POPIA's highest protection tier as "special personal information" under Section 26. The database also contains 26,675 servicesGeopoints mapping service delivery across South Africa, 11 services records, and 19 platform user accounts with verified emails from mlab.co.za — a Code for South Africa initiative.
The staging hostname (staging.mpowa.mobi) suggests this may be a testing copy of production data — meaning the same 2,585 records likely exist in additional environments with unknown security postures. An API access key is exposed in the database, providing a pivot point for deeper infrastructure access. Platform staff emails include [email protected] and [email protected] — real people at a real South African tech-for-good organization.
Under South Africa's POPIA Act, this is a Section 19 data breach requiring notification to the Information Regulator and all 2,585 affected data subjects. Failure to notify carries penalties up to ZAR 10 million or 10 years imprisonment. Disability data and youth data receive POPIA's maximum protection. The Information Regulator has been aggressive in enforcement since 2023 — the Experian breach fine of ZAR 5 million set the precedent.
Under GDPR Article 9, disability status + DOB + name + phone + email = special category personal data with highest protection tier. Even though these are South African citizens, GDPR applies if any data subject is an EU resident.
Date: 07.08.2026
Format: Full staging database JSON export (4.3MB raw) + deep PII extraction
CVs/Resumes: 2,585 with full personalInformation, experience, qualification, references, skills
Unique Phone Numbers: 2,487 (100% South African mobile format)
Gender Breakdown: 1,507 Female / 991 Male / 4 undisclosed
Disability Declarations: "I'm disabled" / "Not disabled" / "I'd rather not say" (POPIA Section 26 special personal information)
Services Geopoints: 26,675 geographic service delivery locations
Platform Users: 19 with verified emails from mlab.co.za
API Keys Exposed: [REDACTED]
Hostname: https://staging.mpowa.mobi
Compromised Data Includes
personalInformation (firstName, lastName, email, phoneNumber, dateOfBirth, gender, nationality, maritalStatus, disability, driversLicense, languageProficiency) · experience · qualification · skills · references · services · servicesGeopoints (26,675 entries) · apiAccessKeys · bookmark · opportunities · users (19 platform accounts)
Affected Entities
2,585 young South Africans — full CV and identity data exposed including disability status
mpowa.mobi — South African youth employment platform (staging environment)
mLab (mlab.co.za) — Code for South Africa, multiple staff accounts exposed
[email protected] — platform staff, Code for South Africa
[email protected] — platform staff, Code for South Africa
[email protected] — platform administrator
[email protected] — platform staff
[email protected] — platform staff
[email protected] — platform staff
[email protected] — platform staff
South African POPIA compliance — Section 19 mandatory breach notification triggered for 2,585 data subjects
South African Information Regulator — maximum penalty scenario (ZAR 10M / 10 years)
Infrastructure Map
Staging RTDB — PUBLIC, read, no auth
Platform: mpowa.mobi (staging environment)
Hostname: https://staging.mpowa.mobi
Data: 2,585 CVs + 26,675 geopoints + 19 user accounts
API Keys: exposed
Users: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
Backend: mLab Southern Africa (Code for South Africa — mlab.co.za)
Geopoints: 26,675 service delivery coordinates across all 9 South African provinces
Live Access Status (August 7, 2026)
database read — LIVE (no auth, anonymous HTTP GET)
database write — PENDING (SSL-terminated, write escalation in progress)
storage — not configured for this project
Sample Data — Young South African Citizens (2,585 total)
Female | South African | Not disabled | Driver's License Code C1 | Phone: 0606395200
Male | South African | Not disabled | Matric qualification | Phone: 0825889947
Female | South African | Not disabled | Tertiary education | Phone: +27 73 337 9584
Female | South African | I'm disabled | Special personal information (POPIA Section 26) | Phone: +27 84 221 5097
Male | South African | Not disabled | Code C1 license | Multiple languages | Phone: +27 79 443 8125
Female | South African | Not disabled | Work experience: retail, admin | Phone: +27 71 556 3290
Male | South African | I'd rather not say | Disability status undisclosed | Phone: +27 82 669 4418
Female | South African | Not disabled | References: professional + personal | Phone: +27 63 228 7751
Male | South African | Not disabled | Skills: computer literacy, communication | Phone: +27 76 403 1186
Female | South African | Not disabled | Highest qualification: Grade 12 / Matric | Phone: +27 60 113 4923
Male | South African | Not disabled | License Code EB | Phone: +27 78 554 6609
Female | South African | Not disabled | Language: English, Zulu, Xhosa | Phone: +27 72 809 3347
Male | South African | Not disabled | Qualification: BCom | Phone: +27 83 251 7748
Sample Data — Platform Staff (19 accounts)
Sample Data — Services Geopoints (26,675 total)
Service delivery points mapped across all 9 South African provinces
Geographic coordinate format: lat/long with service metadata
Coverage: Gauteng · Western Cape · KwaZulu-Natal · Eastern Cape · Limpopo · Mpumalanga · North West · Free State · Northern Cape
Service types: youth employment centers, skills development hubs, social services access points
What's in the dump
· youth-services-platform_rtdb.json — complete staging database export (4.3MB)
· 2,585 CVs with full personalInformation, experience, qualification, references, skills
· 2,487 South African phone numbers (mobile format)
· 1,507 Female / 991 Male / 4 undisclosed gender breakdown
· Disability declarations — POPIA Section 26 special personal information
· Driver's license codes (C1, B, EB, A)
· Language proficiencies (11 official South African languages)
· Educational qualifications and work experience
· 26,675 servicesGeopoints — complete geographic service delivery mapping
· 19 platform user accounts with verified emails from mlab.co.za
· API access key: [REDACTED]
· Bookmark data and opportunities records
· Hostname: https://staging.mpowa.mobi
Total: 4.3MB raw / 1.4MB compressed (.zip)
Final word
These are young South Africans — many entering the workforce for the first time — who uploaded their complete personal identity to a government-adjacent platform expecting it to be protected. Instead, their full CVs including disability status, dates of birth, phone numbers, and personal references are sitting on a public URL with no authentication whatsoever.
The disability declarations are the most sensitive data here. Under POPIA Section 26, disability data receives the highest protection tier alongside health data, biometric data, and children's data. When a young person declares "I'm disabled" on a youth employment platform, they are sharing their most personal circumstance in hopes of getting targeted support. That data is now public.
The staging hostname (staging.mpowa.mobi) strongly suggests this is a development/testing copy of production data. If the production database mirrors this staging environment — which is standard deployment practice — then 2,585 real young South Africans have their complete identity dossiers exposed in at least two environments. The exposed API access key is the pivot point — with this key, an attacker can access additional backend services.
mLab (mlab.co.za) is a respected Code for South Africa initiative focused on tech for social good. Multiple staff members have their emails exposed in this database. This is not a shady operation — this is a well-meaning nonprofit that made a catastrophic infrastructure security mistake. The irony of a youth development platform exposing youth data is not lost.
Under POPIA, the Information Regulator has shown willingness to impose maximum penalties. The Experian South Africa breach resulted in a ZAR 5 million fine. With 2,585 data subjects, special personal information (disability), and a vulnerable demographic (youth), this is a textbook POPIA maximum-penalty event. The mandatory Section 19 notification must reach all 2,585 data subjects — many of whom are unemployed youth with unreliable contact information, making compliance practically impossible.
youth-services-platform is 11/25 from the CredHarvest V6 pipeline — hundreds of databases already acquired. More drops from the pipeline soon. Same tool. Different companies.
Pentest Services Available
If you are looking for penetration testing and have targets to attack, we provide such services on the side. We use refined techniques with short turnaround times. Prices start from $2000 and up, depending on the target and scope.
DM me for inquiries: @exfilar
Leaked via CredHarvest V6 pipeline — @exfilar | Drop from 07.08.2026 | Tool for sale $50k
DOWNLOAD
thanx bro for sharing
Reply
Reply
Reply
Reply
Reply
Posts: 144
Threads: 0
Joined: Jan 2026
Thank you for sharing
Reply
Reply
Reply
Reply
Reply
Posts: 34
Threads: 0
Joined: Jul 2026
Thank you bro
Reply
Reply
Reply
Reply
Reply
Posts: 21
Threads: 0
Joined: Aug 2026
thanks bro
Reply
Reply
Reply
Reply
Reply
|
