![\"\"](\"https:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2019\/05\/Rain-invoice-leak-screenshot.jpg\")
<\/a><\/p>\nRain has fixed a security flaw in its website that allowed subscribers, who were logged into their online profiles, to view the invoices of other clients.<\/p>\n
A MyBroadband reader discovered the flaw after Rain emailed a notice to subscribers who had not set a spend limit on their accounts. The company was encouraging its customers to set a spend limit to avoid bill shock.<\/p>\n
While visiting their Rain dashboard, the subscriber noticed there was an area to download their monthly invoices.<\/p>\n
Upon clicking on it, they noticed that something was amiss, as the URL of the page to download the invoice was in the form “https:\/\/www.rain.co.za\/view-invoice?number=76543210”.<\/p>\n
The number in the URL matched the invoice number. By guessing another valid invoice number, you could access someone else\u2019s invoice.<\/p>\n
Downloaded invoices contained the name and address of the subscriber, along with the product they were being billed for that month.<\/p>\n
\u201cWe acknowledge the issue that allowed a logged-on customer to speculatively view invoices of other customers,\u201d Rain told MyBroadband.<\/p>\n
\u201cThis was due to a bug in the middleware software which has now been resolved.\u201d<\/p>\n
Rain said that it has an internal security team and performs regular tests on its systems, in line with best practices.<\/p>\n
\u201cRain takes the security of our clients\u2019 data extremely seriously. The moment we become aware of any breach and\/or bug in this regard, we immediately act to solve the problem,\u201d the company said.<\/p>\n
For security-related concerns, Rain said that members of the public can send an email to security@rain.co.za.<\/p>\n
Rain has fixed a security flaw in its website that allowed subscribers to view the invoices of other clients.<\/p>\n","protected":false},"author":15,"featured_media":284336,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_threads_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[27],"tags":[35,43716],"class_list":["post-307744","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-headline","tag-rain"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/307744"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=307744"}],"version-history":[{"count":1,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/307744\/revisions"}],"predecessor-version":[{"id":307988,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/307744\/revisions\/307988"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/284336"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=307744"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=307744"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=307744"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}<\/a><\/p>\nNow read: What it takes to work for Rain<\/a><\/h3>\n","protected":false},"excerpt":{"rendered":"