Millions of photos taken by Theta camera owners — some private and unlisted — were left exposed after security researchers found an open database without a password.
Noam Rotem and Ran Locar found the leaky database and reported the exposure to Ricoh, which secured the database within a day. The printing tech giant has sold thousands of the 360-degree camera since the device’s debut in 2014. Users can upload and share their photos and videos to the cloud using the camera.
But that cloud database was left wide open, said Rotem and Locar, who also wrote up their findings. Anyone with access to the database could have easily accessed any of the 11 million photos stored online.
The researchers shared a sample of the data with TechCrunch to verify. We were able to easily access private and unlisted photos uploaded to Ricoh’s website by transplanting into the cloud storage server’s web address the unique file identifier found in the database.
In some cases, the user’s name and captions were also viewable.
When asked, Ricoh spokesperson John Greco did not dispute the researchers’ 11 million figure, but confirmed the exposure: “Ricoh was recently notified of this configuration issue and corrected it within hours.”
“We take the security of customer information extremely seriously. It’s important to note that before the resolution, further steps beyond accessing the records would have been necessary and would require a deeper level of expertise to ultimately view the images. Today, private photos are only accessible to those with a direct link, a design feature that is intended to allow customers to share their images,” said Greco.
Disrupt 2026: The tech ecosystem, all in one room
Your next round. Your next hire. Your next breakout opportunity. Find it at TechCrunch Disrupt 2026, where 10,000+ founders, investors, and tech leaders gather for three days of 250+ tactical sessions, powerful introductions, and market-defining innovation. Register now to save up to $400.
Save up to $300 or 30% to TechCrunch Founder Summit
1,000+ founders and investors come together at TechCrunch Founder Summit 2026 for a full day focused on growth, execution, and real-world scaling. Learn from founders and investors who have shaped the industry. Connect with peers navigating similar growth stages. Walk away with tactics you can apply immediately
Offer ends March 13.
Ricoh later pulled access to photos with direct links, the spokesperson noted in a later email.
Rotem and Locar called the exposure a “major privacy breach.”
Ricoh didn’t say how long the database was exposed. The build date of the database suggests it was created on April 1. But Shodan, a database for exposed devices and databases, first spotted the database on May 9.
The researchers discovered the exposure over a month later, on May 14, but praised the company for its quick remediation.
Read more:
- Flipboard hacks prompt password resets for millions of users
- After breach, Stack Overflow says some user data exposed
- An unsecured SMS spam operation doxxed its owners
- Samsung spilled SmartThings app source code and secret keys
- Security lapse exposed a Chinese smart city surveillance system
- A leaky database of SMS text messages exposed password resets and two-factor codes
- Chipotle customers are saying their accounts have been hacked
