The United States Postal Service’s Informed Delivery service allows users to see scans of their incoming mail. The service has an API that partners and internal systems use. Security researcher Brian Krebs reported in November 2018 that the API contained an endpoint that allowed any authenticated user to request data for any other account.

The endpoint was not in any public documentation. It was part of an internal/partner API that was accessible to all authenticated users — even those who should not have had access to other users’ data.

The API accepted queries for account data using parameters like email address or phone number, and returned: name, address, email address, phone number, mailing campaign data, and other account details for the queried user — regardless of whether the requesting user had any authorization to view that data.