Researcher finds that Voipo, a communications provider based in Lake Forest, CA, left a server with millions of call logs, texts, and more exposed for months
Context & Ripple Effects
Voipo's months-long exposure of millions of call logs and texts fits a well-documented pattern in hosted telephony: Voxox previously left a database streaming millions of SMS texts in near real time, including password reset links and 2FA codes, and Broadvoice later leaked 350M+ customer records with voicemail transcripts. Even a carrier-scale player like Verizon was caught exposing 14M+ customer service records after being notified.
The throughline is that VoIP providers hold the same sensitive metadata carriers do — who called whom, what was said — but often without carrier-grade database hygiene. Zack Whittaker's find adds Voipo, a small Lake Forest provider, to that list.
First-order effects
- Voipo's customers have had their calling and texting histories readable by anyone who found the server for months, and the company now faces an emergency remediation plus disclosure questions about how long it knew.
Second-order effects
- SMBs choosing between VoIP vendors get fresh due-diligence ammunition: Broadvoice's leak already showed the category's risk, and each new incident shifts buyer questions toward where call data is stored and how it is secured.
Third-order effects
- If unsecured telecom databases keep surfacing at this cadence, regulators and enterprise buyers are likely to treat call-log retention by smaller VoIP providers as a systemic risk rather than isolated negligence — pressuring the whole category toward audited storage practices or less data retained at all.
The trend: Hosted-telephony providers are becoming a recurring source of mass metadata exposures, as VoIP platforms accumulate carrier-grade call data without carrier-grade security.