Slide 13 of 28
Part 2 · How It WorksSlide 13
Slide 13 · Vertical BOLA — Real Example
T-Mobile. 37 million customers. One API.
A customer-facing API with no proper authorization check became a mass data breach.
Real Incident · January 2023
T-Mobile API Breach — 37 Million Customers

T-Mobile disclosed that an attacker had been querying a customer-facing API since November 2022 — undetected for about six weeks.

The API was designed to allow authorized systems to look up customer account information. But the authorization check wasn't working correctly. An attacker discovered they could query the API with any phone number and receive full account data: name, billing address, email, phone number, date of birth, T-Mobile account number, and plan details.

No passwords or financial data were exposed — but the attacker pulled 37 million customer records before T-Mobile detected the activity.

What made it vertical: The API was meant for authorized internal or partner systems — not for regular users. A regular query pattern with no valid authorization still returned privileged data. The check existed in theory. It failed in practice.
Six weeks undetected

The attacker wasn't smashing through a wall. They were walking through an unlocked door, calmly, 37 million times. No alarm went off. No rate limit stopped them. No anomaly was flagged — until T-Mobile found it themselves.

← Back Now show me real attack scenarios →