A researcher finds messaging app JusTalk, which has ~20M users, exposed a database with millions of conversations and call logs in plaintext since January 2022
Context & Ripple Effects
JusTalk is the latest entry in a long line of consumer apps caught leaving user communications wide open: Voipo left millions of call logs and texts exposed for months, Voxox streamed SMS traffic including password reset and 2FA codes in near real time, and Whisper leaked hundreds of millions of intimate messages tied to location data. What distinguishes this one is duration and content — a messaging app's own conversation archive sitting in plaintext since January 2022, found by TechCrunch's Zack Whittaker.
The pattern across these incidents is consistent: small-to-mid-size communication apps treat message history as an operational asset they must keep online, and misconfigure cloud storage rather than encrypt it at rest. With roughly 20M users, JusTalk sits squarely in the size band where these exposures keep recurring.
First-order effects
- Millions of JusTalk users have had private conversations and call logs readable by anyone who found the database for over six months, with no way to know who accessed it before the researcher did.
- JusTalk faces immediate remediation costs — securing the database, notifying affected users, and answering questions about why chat content was stored unencrypted at all.
Second-order effects
- Competing messaging apps gain a marketing opening around end-to-end encryption and minimal data retention, pressuring the whole mid-tier video-calling market to justify what it stores server-side.
- App store reviewers and enterprise buyers evaluating communication tools get a fresh case study for demanding encryption-at-rest attestations, raising the compliance bar for smaller developers.
Third-order effects
- If the unsecured-database pattern keeps repeating — from AI.type's contact dump through Voipo, Voxox, and now JusTalk — regulators and platform gatekeepers are pushed toward requiring verifiable data-handling standards for consumer communication apps rather than trusting self-reported privacy policies.
- The recurring exposure of retained conversation archives strengthens the argument that messaging products should architect for ephemerality and client-side encryption by default, making 'we kept everything on one open server' a design failure rather than an ops slip.
The trend: Consumer communication apps keep leaking entire message archives through misconfigured storage, steadily eroding trust in any messenger that retains plaintext conversations server-side.