2018 — T-Mobile: ZDNet's Zach Whittaker reports:A bug in T-Mobile's…
Data compromised
Personal information
Technical writeup
ZDNet's Zach Whittaker reports:A bug in T-Mobile's website let anyone access the personal account details of any customer with just their cell phone number.The flaw, since fixed, could have been exploited by anyone who knew where to look -- a little-known T-Mobile subdomain that staff use as a customer care portal to access the company's internal tools. The subdomain -- promotool.t-mobile.com, which can be easily found on search engines -- contained a hidden API that would return T-Mobile custom
Root cause
Unintended disclosure