Peloton (2021) — age, weight, location, workout history of 4 million users. Accessible with no authentication. Just change the user ID in the URL.
📱
37 million customer records stolen
T-Mobile (Jan 2023) — names, billing addresses, emails, phone numbers, account numbers. An attacker queried a customer API by phone number for months before detection.
📍
Exact locations of dating app users leaked
Bumble (2020) — researcher Sanjana Sarda found any user's precise GPS coordinates were returned via API, even for users who had blocked the requester.
📬
60 million accounts exposed
USPS Informed Delivery (2018) — any authenticated user could look up account details for any other USPS user by changing the user ID. Name, address, email, phone number.
🔑
Account takeover
When exposed data includes email addresses and security question answers, BOLA can be a first step toward fully taking over an account.
The pattern
Every one of these breaches had the same root cause. The API returned data based on an ID the user supplied — without checking if that user was allowed to access it.