2024 It's My Data — API allowed access to others' credit reports
Data compromised
Credit reports, dunning, insolvency
Technical writeup
Lilith Wittmann: unprotected API. Change own account data to access others' credit reports. Dunning, insolvencies. No technical skill required. Company shut down login.
Root cause
Unprotected API; IDOR