A London-based popular massage-booking app left its online database containing 309,000 customer profiles unsecured, the media reported.
Urban, previously known as Urban Massage, left its Google-hosted ElasticSearch database online without a password.
Among the records were allegations of sexual assault, linked to identifiable individuals, the BBC reported on Wednesday.
The problem was discovered by researcher Oliver Hough, who shared the discovery with news site TechCrunch.
The database also contained more than 2,000 records on Urban massage therapists, including their names, email addresses and phone numbers, according to the TechCrunch report.
But it did not leak any financial information -- such as credit cards or individual account passwords.
Many records also included allegations of sexual misconduct by clients -- such as asking for "massage in genital area" and requesting "sexual services from therapist."
"This data could literally have led to some serious blackmail," Hough wrote on Twitter.
Urban said it took the database offline, and was investigating the issue.
Parents Gave Names Of Interns, Doctors To CBI In Kolkata Horror: Sources Who Is Jasveen Sangha, "Ketamine Queen" Charged With Matthew Perry's Death How Extreme Weather Is Leading To Rise In Child Marriages In Pakistan Police Arrest Suspect In Bihar Dalit Girl Kidnapping, Murder Case 80 Killed In Paramilitary Attack In Sudan OpenAI Blocks Iranian Group's ChatGPT Accounts For Targeting US Election Track Latest News Live on NDTV.com and get news updates from India and around the world.