THIS!

The headline is about them getting locked on, because that's funny, but the buried lead is actually this:

> The security researchers said they discovered a way to fool the server into disclosing the registered name of each device owner, among other personal details, as well as the co-ordinates of every location from where the app had been used.

That's some really sensitive info, with the potential to destroy some lives, or be used as blackmail material.