Subject: Request for Fraud Investigation - Exposure of PII via PuroLabs Web Portal
From: "Chauhan, Kiran" <[email-masked]>
To: Fraud Risk <[email-masked]>, "Grabka, Dariusz" <[email-masked]>
Cc: "McCulloch, Brenda" <[email-masked]>, "Johal, Jasraj" <[email-masked]>, "IT Security (Purolator)" <[email-masked]>, "Monie, Arvin" <[email-masked]>, "Hughes, Jamie" <[email-masked]>
Date: Sat, 8 Nov 2025 19:49:38 +0000

Hi Team,
During recent testing of Purolator’s DeliveryPro mobile application and web portal (https://deliveryproconsole.com/), the Information Security Office identified a critical vulnerability involving a hardcoded Azure API Management (APIM) subscription key embedded in client-side JavaScript.

Summary of Findings:

  *   A hardcoded Azure API Management (APIM) subscription key was found in client-side JavaScript (unminified.js, line 373660).
  *   This key grants unrestricted access to Purolator’s backend API infrastructure — no authentication, IP restrictions, or rate limiting are in place.
  *   Exploitation has already enabled extraction of 1,000+ records containing sensitive PII, including:
     *   240 agency business profiles with contact details.
     *   525+ active driver records (names, phone numbers, emails, unique identifiers).
     *   235 pending driver applications.
     *   Real-time shipment data, including recipient names, addresses, phone numbers, delivery instructions, and GPS coordinates.
  *   APIs also expose endpoints that could potentially be used to manipulate operational data (e.g., parcel assignment, driver notifications, delivery status).

Given the nature and scope of the exposed data, we request the Fraud Risk team to investigate for any signs of misuse or fraudulent activity stemming from this vulnerability.

  *   Investigate for any signs of data misuse or fraud.
  *   Review recent activity for anomalies related to driver onboarding, shipment manipulation, or unauthorized access.

Please let us know if you require additional support from the Information Security Office.

Regards,

Kiran Chauhan
Technology Manager Information Security Office

Subject: Chat conversation with Johal, Jasraj, Monie, Arvin from Microsoft Teams

During testing of Purolator's (FYI this is also PuroLabs) DeliveryPro mobile application and web por 
Microsoft Teams
Johal, Jasraj    21 minutes ago

During testing of Purolator's (FYI this is also PuroLabs) DeliveryPro mobile application and web portal - https://deliveryproconsole.com/, another critical vulnerability was discovered: an Azure API Management (APIM) subscription key hardcoded in client-side JavaScript code (unminified.js, line 373660). This subscription key provides unauthorized access to Purolator's entire backend API infrastructure without any additional authentication, IP restrictions, or rate limiting. Exploitation of this vulnerability enabled extraction of 1,000+ records containing sensitive Personally Identifiable Information (PII) including: 240 agency business profiles with contact details, 525+ active driver records (names, phone numbers, emails, unique identifiers), 235 pending driver applications, and real-time access to active shipment data with full recipient information (names, addresses, phone numbers, delivery instructions, GPS coordinates). The exposed APIs also include endpoints for potentially manipulating operational data such as parcel assignment, driver notifications, and delivery status updates.

https://www.purolator.com/en/shipping/tracker?pin=520142534723&sdate=2025-11-06

    {

      "pin": "520139496142",

      "terminalId": "174",

      "terminalName": "St. John's",

      "consigneeAddressId": 14851910,

      "consigneeAddress": {

        "id": 14851910,

        "name": "JANICE BAIRD",

        "addressLine1": "20 BAIRDS LANE",

        "addressLine2": "",

        "unit": "",

        "city": "CONCEPTION BAY SOUTH",

        "postalZip": "A1W 4X4",

        "provState": "NL",

        "country": null,

        "phoneNumber": "17096972615",

        "geo": {

          "lat": 47.51552,

          "lng": -52.97003

        },

        "addressSource": null

      },

      "alternateAddressId": null,

      "alternateDeliveryAddress": null,

      "weight": 1.0,

      "status": "Delivered",

      "globalUserId": "VYT5MYFBS4",

      "globalUserName": "Yurii Tkach",

      "agencyId": "WITHIN_REACH",

      "statusId": 3,

      "parcelType": "delivery",

      "pickupNumber": null,

      "eventType": null,

      "eventDateTime": "2025-11-08T10:18:03-05:00",

      "created": "2025-11-08T03:35:37-05:00",

      "modified": "2025-11-08T13:48:04.930907-05:00",

      "totalCount": 0

    },

    {

      "pin": "520142534723",

      "terminalId": "174",

      "terminalName": "St. John's",

      "consigneeAddressId": 14852267,

      "consigneeAddress": {

        "id": 14852267,

        "name": "OJEDA,MARIANA",

        "addressLine1": "170 TORBAY RD",

        "addressLine2": "",

        "unit": "226",

        "city": "ST. JOHN'S",

        "postalZip": "A1A 2H3",

        "provState": "NL",

        "country": null,

        "phoneNumber": "17092198440",

        "geo": {

          "lat": 47.59371,

          "lng": -52.70883

        },

        "addressSource": null

      },

      "alternateAddressId": null,

      "alternateDeliveryAddress": null,

      "weight": 0.9,

      "status": "Delivered",

      "globalUserId": "3SR4X6OK3Q",

      "globalUserName": "Annette Hawkins",

      "agencyId": "WITHIN_REACH",

      "statusId": 3,

      "parcelType": "delivery",

      "pickupNumber": null,

      "eventType": null,

      "eventDateTime": "2025-11-08T10:17:06-05:00",

      "created": "2025-11-08T04:13:14-05:00",

      "modified": "2025-11-08T13:47:06.903522-05:00",

      "totalCount": 0

    },