2018 Platform vulnerability — hundreds of banks
Data compromised
Emails, phones, bank account numbers
Technical writeup
Aug 2018. Critical flaw in web platform used by hundreds of banks. Transaction alert system used sequential event numbers; could be manipulated to view other customers' data. Exposed: emails, phones, full bank account numbers. Primarily small community banks and credit unions.
Root cause
Insecure sequential event IDs; IDOR vulnerability.