Klarna mobile app bug let users log into other customers' accounts

Klarna Bank suffered a severe technical issue this morning that allowed mobile app users to log into other customers' accounts and see their stored information.

Klarna is a Swedish bank that allows customers to make purchases and finance them over time.

Today, customers reported that when they logged into the Klarna mobile app, they were showed the account information for other users instead of seeing their own accounts.

This technical issue is illustrated in a video shared by a user on Twitter, seen below.

@Klarna @AskKlarna has a major security issue on their hands this morning!!!! Every sign in is a different persons details pic.twitter.com/0JsTGcGIgE

After Klarna learned about the technical issue, they took their mobile app offline, which now shows a message stating, "Sorry, the Klarna app is currently down for maintenance."

Klarna mobile app disabled

Klarna states that a recent update led to the technical issue that exposed the data of 0.1%, or approximately 90,000, users.

"This is why we are sad and frustrated to inform you of a self-inflicted incident, that for 31 min affected up to 0.1%, approximately 90 000, of our users.The bug led to random user data being exposed to the wrong user when accessing our user interfaces," Klarna said in a statement about the mobile app bug.

"It is important to note that the access to data has been entirely random and not showing any data containing card or bank details (obfuscated data was visible)."

"This means that it has been impossible to access a specific user’s data. According to GDPR standards, only non-sensitive data was exposed. However we recognize that what is deemed non-sensitive is very individual, and we set our own standards higher than GDPR."

While Klarna states that the bug exposed only non-sensitive data, users report that this is not accurate. When logged into other people's accounts, they could see sensitive data, including names, mobile numbers, addresses, stored bank accounts, purchases, and saved credit cards.

To make matters worse, Klarna customers state that each time they logged into the mobile app, they would get access to a different account.

Oh dear… I can see all the information they provided including stored bank details, addresses, phone numbers, purchases etc. This doesn’t look good @Klarna @AskKlarna

BleepingComputer has contacted Klarna to learn more about the conflicting reports regarding their statement and customers' experiences.