Bluspark left its global shipping platform exposed, then couldn't be reached

Bluspark Global, the little-known New York firm whose Bluvoyix platform powers shipping and cargo tracking for hundreds of large companies — retail giants, grocery stores, furniture makers — left the doors to its shipping platform 'wide open to anyone on the internet,' TechCrunch reported. Five flaws included employees' and customers' passwords stored in plaintext and an API whose documentation page let anyone run commands as a logged-in user without credentials, exposing shipment records dating back decades.

Security researcher Eaton Zveare discovered the vulnerabilities in October 2025 through a customer's own website contact form, which embedded email-sending code that could be abused to send phishing lures from a real Bluspark customer's address. Then came the harder problem: Bluspark had no discernable way to contact it. Zveare routed his report through the Maritime Hacking Village nonprofit, and after weeks of emails, voicemails and LinkedIn messages, the company had not responded — all while the flaws stayed exploitable.

TechCrunch stepped in, emailing CEO Ken O'Brien and senior leadership without response, then alerting a publicly traded retail customer — also nothing. Only when the third email to the CEO included a partial copy of his own password did Bluspark respond, via a law firm. The company has since fixed all five flaws, telling TechCrunch its security issues are resolved.

Decades of customer shipment records and employee and customer passwords stored in plaintext were reachable by anyone on the internet for months.

The API returned sensitive data — including plaintext passwords and an administrator account — without any credentials, despite its documentation claiming authentication was required.

A customer contact form embedded email-sending code in the page itself, letting anyone send phishing from a real Bluspark customer's address.

The company had no discernable vulnerability-reporting channel: weeks of researcher contacts through every route went unanswered.

If nobody can report a security flaw to you, you have decided to learn about it from a breach — build the front door before you need it.

Bluspark fixed the five flaws and told TechCrunch its security issues were resolved; the response came through a law firm only after TechCrunch included a partial copy of the CEO's password in its email. The backdrop: security researchers had spent the past year urging the shipping industry to harden up amid cargo thefts linked to hackers colluding with organized crime.