2017 ShopClues — IDOR via short links
Data compromised
Names, phone, email, addresses, orders
Technical writeup
Order tracking sclu.es links serially iterable. Names, phone, email, addresses, order details. Fixed May 2017.
Root cause
IDOR; predictable URLs