An organization maintains a staging environment at staging.api.company.com. It was created to mirror production for QA testing. To make testing faster, the team copied production data to staging three months ago. The environment was temporarily given a public IP for a vendor integration test and never moved back behind the VPN.

Staging uses the same codebase as production but was configured with AUTH_REQUIRED=false to simplify automated testing. No monitoring alerts are set up for staging. The security team’s WAF rules, rate limiting, and intrusion detection apply only to production.

An attacker enumerating subdomains through certificate transparency logs finds staging.api.company.com. They call GET /api/v2/users — no auth header — and receive a paginated list of real user accounts from the three-month-old production copy. They download the full dataset in 40 minutes. The production API is never touched.