When one Auckland man borrowed a phone from 2degrees in the north Auckland suburb of Albany, he was shocked to find the details of the previous user were still on the device.
Michael Waine had sent his iPhone in for repair but got more for he bargained for when he turned the replacement on.
"I signed for it and then I walked out of the store, I caught a flight to Wellington and by the time I got to Wellington I realised that all of this other person's details were on there."
The phone was still logged in to the previous borrower's iCloud account, a 16 year old Auckland girl, giving Michael access to her photos, contacts and bank account details.
"All of the information was still updating, her notes, photos, everything"
In order to log out of the iCloud account, he needed the password from a girl he had never met. So he called the girl's father, who was equally as surprised to get a phone call from the man.
"This guy called me on Saturday morning and explained what had happened" said the girl's father Ian Spargo.
However Mr Spargo wasn't comfortable giving the password to a stranger over the phone so he called 2degrees in the hope of some clarification.
"Last Wednesday my wife took the phone back to the store - she had deleted all of the apps but they [2degrees] said they would factory reset it."
However, that wasn't the case.
"I went in there yesterday, they assured me the phone had been reset but his photos are turning up on her iPhone. They are turning up on her photo stream." Mr Spargo said.
He is just glad the man who ended up with his daughter's details was "decent enough".
"He might not even have rung us ... this man has access to all my daughter's photos of her and her friends."
"It's a bit dodgy".
Mr Waine, who is taking the phone back to 2degrees today, is worried about the breach of privacy.
"They should have logged out [of the iCloud account] ... but at the end of the day, all of her information was exposed."
"I would be extremely unhappy if that would happen to me."
Spokeswoman for 2degrees Charlene White said they are investigating the breach.
"2degrees takes the privacy of our customers extremely seriously and is very concerned about this incident. Our strict in-store policies requires all loan phones to be reset and checked thoroughly again prior to being loaned out to other customers."
She said as a result, staff have been reminded of the importance of the processes and policies that protect customer's identities.
"We provide loan phones to customers on a regular basis and to our knowledge, a breach of this kind has never happened before," she said.
Newshub.
