2024 API abuse — 15.1M email addresses
Data compromised
Email addresses, names, usernames, user IDs
Technical writeup
Jan 2024. Threat actor "emo" exploited unsecured Trello REST API to map email addresses to Trello accounts. Used 500M emails from prior breaches; identified 15.1M linked to Trello. Data released on Breached forum Jul 2024. Exposed: emails, names, usernames, user IDs, profile URLs. Atlassian secured API after discovery.
Root cause
API vulnerability; unauthenticated email-to-account mapping.