Personal or sensitive data exposed
Unauthorised access to PII or PHI through auth, API or storage faults.
Severity: data. Attached to 42 of 46 published product types, backed by 52 evidence records.
Product types that carry it
| Product type | Grade | Note for this type | Evidence |
|---|---|---|---|
| mobile banking app | primary | An app fault shows a logged-in customer another account holder's personal data. | |
| neobank | secondary by design analysis | By design analysis: the app stores ID document photos, selfies and proof of address from remote onboarding, so a storage or API fault exposes identity kits. | |
| peer-to-peer payment app | primary | Payment notes and payer and payee names appear on a public social feed by default, and one party's privacy setting overrides the other's, or a departed employee keeps access to internal customer reports. | |
| crypto exchange | primary | Bribed support agents collect customer data from the exchange's support systems, giving scammers a target list of crypto holders. | |
| lending platform | secondary by design analysis | By design analysis: a loan file holds pay stubs, bank statements, SSN and a credit report, and an ID change in the loan URL can expose another applicant's file. | |
| buy now pay later service | secondary by design analysis | By design analysis: the shopper account shows every financed purchase, merchant and repayment card, and a cached checkout or account response can be served to a different shopper. | |
| stock trading app | practitioner single incident, no second source | An attacker who talks a support agent into access pulls customer names and emails from support tooling that can see every brokerage account. | |
| insurance app | primary | The instant-quote form prefills a driver's license number for any name and birth date typed in, so attackers harvest licence numbers without buying a policy. | |
| accounting and invoicing SaaS | primary | An attacker guesses a weak password on a company ledger, downloads payroll and tax figures, and files a fraudulent tax return in the business's name. | |
| expense management tool | secondary by design analysis | Receipt images show hotel folios, home addresses and card numbers, and an approver can open another department's receipts by changing a report ID. | |
| telemedicine app | primary | A shared login session opens another patient's visit notes, and a clinician who left the practice can still read charts from past video visits. | |
| patient portal | primary | A proxy link set on the wrong account lets an unrelated adult read a child's visit summaries, and a pixel on the signed-in results page reaches an ad network. | |
| software as a medical device | secondary by design analysis | An unauthenticated Bluetooth or cloud command channel lets a nearby or remote attacker read therapy history or send a setting to the paired device. | |
| mental health app | primary | The onboarding questionnaire that asks about depression, self-harm or drinking sends each answer as an event to an ad platform, which then targets the user by condition. | |
| pharmacy delivery app | primary | A patient opens their order history and sees another patient's medication list, or a former pharmacy technician still reads prescription records after offboarding, or medication pages send drug names to advertising platforms through tracking code. | |
| clinical trial management software | secondary by design analysis | A sponsor monitor exports subject listings and the file carries participant names and dates of birth from the site's source upload instead of subject IDs. | |
| wearable companion app | primary | A stranger's phone within Bluetooth range pairs with the band without the owner's confirmation and reads its stored heart-rate and sleep history, or an analytics SDK sends heart-rate, sleep or cycle data to a third party the user did not authorise, which the FTC rule treats as a breach to notify. | |
| ecommerce store | primary | A changed third-party script on the checkout page copies every card number typed into the payment form to another domain while orders keep completing. | |
| online marketplace | secondary by design analysis | A seller changes the order id in the order API and reads the shipping address and phone number of buyers who ordered from a different seller. | |
| subscription box service | secondary by design analysis | A gift-subscription redemption link exposes the recipient's delivery address and the giver's billing name to anyone who guesses the next code. | |
| grocery delivery app | secondary by design analysis | Saved weekly lists, home addresses, delivery slots and doorstep notes together show when a household is in and how to get to the door. | |
| event ticketing platform | secondary by design analysis | A ticket transfer link or barcode endpoint that accepts another order number exposes the buyer's name, email and seat to anyone. | |
| travel booking app | secondary by design analysis | A booking reference and surname are enough to open a trip, so a guessable lookup exposes passport numbers and travel dates. | |
| ride-hailing app | primary | An attacker reaches internal tools through a contractor account that accepted a repeated two-factor push, at an operator whose earlier breaches exposed rider and driver data. | |
| loyalty program app | primary | Membership numbers leak alongside names and payment cards, and the operator must then restore points stolen from those member accounts. | |
| email marketing platform | primary | A support-console login phished from platform staff opens customer accounts, and with them every subscriber list and the account's sending domain. | |
| ERP system | primary | An internet-facing ERP component left on a version with a known exploited vulnerability lets an attacker list and take files from the ERP environment. | |
| e-signature service | secondary by design analysis | A forwarded or guessed signing link opens a contract with salary, ID numbers and bank details without any check that the opener is the named signer. | |
| video conferencing tool | primary | A social-login SDK in the iOS meeting client collects device information, and a hidden local web server installed by the Mac client stays after the app is deleted. | |
| identity and access management service | primary | A customer admin's HAR file on a support ticket carries a live session token issued by the identity service, so whoever reads the ticket acts as that admin in a tenant whose sign-ins the customer's other apps trust, or a compromised workstation of an outsourced support engineer exposes the support tools that act on customer tenants. | |
| SDK or client library | primary | A new maintainer of a transitive dependency publishes a release carrying malicious code, and host apps that update the SDK pull it into their builds. | |
| desktop application | primary | The installer adds a local web server or helper that any web page can call, and it stays on the machine after the app is deleted. | |
| data pipeline | secondary by design analysis | Raw extracts with personal fields land in a staging bucket or temp table that the masking step never reaches and analysts can query. | |
| machine learning model service | secondary by design analysis | Prediction logs keep raw request payloads with personal fields, and they are copied into training sets and debugging dashboards without access limits. | |
| LLM-based assistant | primary | A fault in the chat history layer exposes users' conversations and subscribers' payment details. | |
| smart home or IoT app | primary | The phone app keeps the camera account password in clear text on the handset, or the account accepts passwords leaked from other sites, and an outsider watches the live feed of the home. | |
| fleet and logistics tracking | primary | An API that trusts a tracker's device ID lets anyone read another company's live vehicle positions and route history. | |
| social network | practitioner single incident, no second source | A "see your profile as someone else" preview leaks the viewed person's session token, and attackers log in as them. | |
| dating app | primary | A breach exposes member profiles after weak access controls go unmonitored, and a paid profile deletion leaves the member's record in the database. | |
| messaging app | secondary by design analysis | Chat history, attachments or contact lists stored on the phone are readable by other apps or copied into an unprotected backup when the phone is lost or shared. | |
| kids app | practitioner single incident, no second source | A toy's companion app ships an SDK that collects the child's geolocation for a third party abroad, outside anything the parent agreed to. | |
| government services portal | primary | Personnel and background investigation records held by the agency are taken from its systems, or a staff account without phishing-resistant multi-factor sign-in is taken over. |
Tests that address it
- release smoke tests: mandatory for this risk on 5 product types.
- penetration testing: mandatory for this risk on 39 product types.
- regression suite: mandatory for this risk on 5 product types.
- security scanning: mandatory for this risk on 42 product types.
- end-to-end functional tests: mandatory for this risk on 3 product types.
- compliance checks: mandatory for this risk on 9 product types.
- analytics and event tracking tests: mandatory for this risk on 6 product types.
- integration tests: mandatory for this risk on 2 product types.
- data integrity and migration testing: mandatory for this risk on 1 product types.
Evidence
ev-0010standardprimary
PCI DSS document library, PCI Security Standards Council
PCI DSS sets security requirements, including vulnerability scanning and penetration testing, for any system that stores, processes or transmits cardholder data.
published undated · verified 2026-10-07
ev-0011standardprimary
OWASP Top Ten, OWASP Foundation
The OWASP Top Ten lists the most critical web application security risk categories, such as broken access control and injection.
published undated · verified 2026-10-07
ev-0012standardprimary
OWASP API Security Top 10 2023, OWASP Foundation
The API Security Top 10 names API-specific failures such as broken object level authorization and unrestricted resource consumption.
published undated · verified 2026-10-07
ev-0013standardprimary
OWASP Mobile Application Security Verification Standard (MASVS), OWASP Foundation
MASVS defines security requirements for mobile apps, including secure storage, network communication and authentication.
published undated · verified 2026-10-07
ev-0014standardprimary
OWASP Application Security Verification Standard (ASVS), OWASP Foundation
ASVS gives testable security requirements for web applications and services, grouped by verification level.
published undated · verified 2026-10-07
ev-0025regulatorprimary
Regulation (EU) 2016/679 (General Data Protection Regulation), EUR-Lex, European Union
The GDPR sets lawful basis, consent, data subject rights, security of processing (Article 32) and breach notification duties for anyone processing personal data of people in the EU.
published undated · verified 2026-10-07
ev-0037standardprimary
NIST SP 800-63B: Digital Identity Guidelines, Authentication and Authenticator Management, National Institute of Standards and Technology
SP 800-63B sets requirements for authenticators, multi-factor authentication, session management and throttling of guessing attempts.
published undated · verified 2026-10-07
ev-0043court-or-fineprimary
Operator of Online Tax Preparation Service Agrees to Settle FTC Charges That it Violated Financial Privacy and Security Rules, Federal Trade Commission
Supports data-breach for accounting SaaS that produces tax reports: attackers guessed weak passwords to take over accounts of an online tax preparation service and used the stored tax data to file fraudulent returns. The same login and stored tax data exist in small-business accounting software that prepares tax reports.
published 2017-08-29 · verified 2026-10-07
ev-0054regulatorprimary
Guideline on computerised systems and electronic data in clinical trials (EMA/INS/GCP/112288/2023), European Medicines Agency, GCP Inspectors Working Group
Where the randomisation is stratified by factors inputted by the user, all the combinations of the strata should be tested to confirm that the allocation is occurring from the correct randomisation table.
EMA inspectors expect trial systems to keep a secure audit trail, restrict unblinded data to named roles, test emergency unblinding and test randomisation strata and dose calculations in response technology, which covers data corruption and participant harm in trial software.
published 2023-03-09 · verified 2026-10-07
ev-0062post-mortemprimary
Coinbase Global, Inc. Form 8-K (May 14, 2025), Coinbase Global, Inc. (filed with the U.S. Securities and Exchange Commission)
Company filing on a crypto exchange incident in which bribed support staff collected customer data from internal support systems, after which the exchange added fraud monitoring and warned customers of impersonation. Supports data-breach and fraud-abuse for crypto exchanges.
published 2025-05-14 · verified 2026-10-07
ev-0073court-or-fineprimary
Penalty Notice: British Airways plc (COM0783542), Information Commissioner's Office
The ICO penalty describes an attacker modifying a script on a booking site's payment page so card data was copied to an attacker domain while checkout kept working; any store that renders its own card form carries the same exposure.
published 2020-10-16 · verified 2026-10-07
ev-0092regulatorsecondary
The OPM Data Breach: How the Government Jeopardized Our National Security for More than a Generation, U.S. House Committee on Oversight and Government Reform
Supports data-breach for a government services portal: the congressional report documents theft of personnel and background investigation records from a federal agency's systems.
published 2016-09-07 · verified 2026-10-07
ev-0093court-or-fineprimary
Attorney General James and DFS Superintendent Harris Secure [amount] from Auto Insurance Companies over Data Breaches, New York State Department of Financial Services
Hackers were able to obtain New Yorkers' driver's license numbers from GEICO's publicly-facing website because GEICO failed to protect this information on the website's back end.
Supports data-breach and regulatory-penalty for an insurance app: attackers pulled driver's license numbers from public online quoting tools and the insurers were penalised under the state cybersecurity regulation.
published 2024-11-25 · verified 2026-10-07
ev-0094court-or-fineprimary
Attorney General James Secures [amount] from Car Insurance Companies Over Data Breaches, New York State Attorney General
Supports data-breach for an insurance app: the instant-quote prefill feature returned driver's license numbers for anyone whose name and birth date an attacker typed in, a second enforcement action on the same failure pattern.
published 2025-10-14 · verified 2026-10-07
ev-0101regulatorprimary
FTC Safeguards Rule: What Your Business Needs to Know, Federal Trade Commission
General requirement for data-breach on a lending platform: the rule names lenders and finance companies as covered financial institutions and requires penetration testing and periodic vulnerability scans. A BNPL provider extends consumer credit as a finance company, so the same requirement transfers to it.
published undated · verified 2026-10-07
ev-0105regulatorprimary
FTC Finalizes Order with Marriott and Starwood Requiring them to Implement a [...] Data Security Program to Address Data Breaches, Federal Trade Commission
FTC order after breaches that exposed loyalty numbers with other personal data, including payment card numbers and passport information; it requires deletion requests by loyalty account number and restoring stolen loyalty points on request. Supports data-breach for loyalty program apps.
published 2024-12-20 · verified 2026-10-07
ev-0109regulatorprimary
FTC Gives Final Approval to Order Banning BetterHelp from Sharing Sensitive Health Data for Advertising, Requiring It to Pay [amount], Federal Trade Commission
Final FTC order against an online counseling service that sent email addresses, IP addresses and health questionnaire answers to ad platforms after promising privacy. Supports data-breach and regulatory-penalty for mental health apps whose intake questionnaire reveals the user's condition, and for telemedicine apps that run the same intake before a therapy visit.
published 2023-07-14 · verified 2026-10-07
ev-0111regulatorprimary
FTC Finalizes Changes to the Health Breach Notification Rule, Federal Trade Commission
FTC rule update stating that health apps outside HIPAA are covered and that an unauthorized disclosure of identifiable health information counts as a breach that must be notified. Supports regulatory-penalty and data-breach for mental health apps and fitness apps that sell direct to consumers, and wearable companion apps, since the FTC ties the update to health apps and connected devices.
published 2024-04-26 · verified 2026-10-07
ev-0114regulatorsecondary
Nearly half a million Lloyds Banking Group customers affected by personal data glitch, UK Parliament, House of Commons Treasury Committee
Supports data-breach for mobile banking apps.
published undated · verified 2026-10-07
ev-0122court-or-fineprimary
PayPal Settles FTC Charges that Venmo Failed to Disclose Information to Consumers About the Ability to Transfer Funds and Privacy Settings; Violated Gramm-Leach-Bliley Act, U.S. Federal Trade Commission
FTC settlement over a P2P app that told users received money was available to transfer while it could still be frozen or removed after review, shared transactions publicly by default, and did not notify users of password or new device changes. Supports money-loss, data-breach and fraud-abuse for P2P payment apps.
published 2018-02-27 · verified 2026-10-07
ev-0123post-mortemprimary
Block, Inc. Form 8-K (April 4, 2022), Block, Inc. (filed with the U.S. Securities and Exchange Commission)
Company filing on a former employee downloading customer reports after employment ended, from a subsidiary of a P2P payment app. Supports data-breach for P2P apps through internal report access that is not revoked at offboarding.
published 2022-04-04 · verified 2026-10-07
ev-0124post-mortemprimary
Privacy Matter | Kaiser Permanente, Kaiser Permanente
Certain online technologies (commonly known as cookies or pixels) installed on our websites and mobile applications may have transmitted personal information to our third-party vendors Google, Microsoft Bing, and X (Twitter)
Official notice from a health system: pixels on its member websites and apps sent names, signed-in status, navigation and health encyclopedia searches to ad and search companies. Supports data-breach for patient portals, where the signed-in state itself reveals that the person is a patient.
published 2024-05-06 · verified 2026-10-07
ev-0125post-mortemprimary
Breach Name: Inappropriate Access (notification letter, reference 23-045KV), University of Rochester Medical Center
The other patient who viewed your MyChart account was assigned in error.
Official breach notification: an unrelated patient was set as proxy on a minor's portal account and could read the child's appointments, messages and visit summaries until the proxy reported it. Supports data-breach for patient portals with proxy or guardian access.
published 2023-03-23 · verified 2026-10-07
ev-0141regulatorprimary
FTC Enforcement Action to Bar GoodRx from Sharing Consumers' Sensitive Health Info for Advertising, U.S. Federal Trade Commission
GoodRx violated the Health Breach Notification Rule by failing to notify consumers, the FTC, and the media about the company's unauthorized disclosure of individually identifiable health information to Facebook, Google, Criteo, Branch, and Twilio.
A prescription drug service sent users' medication data to advertising platforms through tracking tools; a pharmacy delivery app that fires ad or analytics events on medication pages carries the same enforcement risk.
published 2023-02-01 · verified 2026-10-07
ev-0142regulatorprimary
Proposed FTC Order will Prohibit Telehealth Firm Cerebral from Using or Disclosing Sensitive Data for Advertising Purposes, and Require it to Pay [amount], U.S. Federal Trade Commission
The FTC complaint describes pharmacy and prescription information sent to third parties through tracking tools, a patient portal access method that exposed medications to other patients, a failure to block former employees from accessing medical records, and a cancel-anytime promise contradicted by a multi-step, often multi-day cancellation process during which consumers kept being charged. The first two transfer to pharmacy delivery apps; the cancellation finding transfers to any recurring subscription sold online.
published 2024-04-15 · verified 2026-10-07
ev-0156regulatorprimary
Uber Technologies, Inc., In the Matter of, Federal Trade Commission
FTC consent order against a ride-hailing company over deceptive privacy and data security claims after breaches of rider and driver data. Supports data-breach for ride-hailing apps, which hold rider trip data and driver licence data.
published 2018-10-26 · verified 2026-10-07
ev-0157post-mortemprimary
Security update, Uber
Eventually, however, the contractor accepted one, and the attacker successfully logged in.
Official incident report: an attacker with a contractor password got past push-based two-factor approval by repeated prompts and reached internal tools. Supports data-breach for ride-hailing apps through operator and support tooling access.
published 2022-09-19 · verified 2026-10-07
ev-0167regulatorprimary
Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions, U.S. Food and Drug Administration
FDA guidance on cybersecurity design, labeling and premarket documentation for devices with cybersecurity risk, including section 524B cyber devices. Supports data-breach (by design) and regulatory-penalty for SaMD that connects to phones, clouds or networks.
published undated · verified 2026-10-07
ev-0170regulatorprimary
Alcohol Addiction Treatment Firm will be Banned from Disclosing Health Data for Advertising to Settle FTC Charges that It Shared Data Without Consent, Federal Trade Commission
Monument used the information to target ads for its services to both current users who subscribe to the lowest cost memberships and to target new consumers, according to the complaint.
Enforcement against an online alcohol use disorder treatment service whose pixels and APIs sent intake and treatment events to ad platforms without consent. Supports data-breach and regulatory-penalty for telemedicine apps and for mental health apps, which collect the same kind of intake answers.
published 2024-04-11 · verified 2026-10-07
ev-0183post-mortemprimary
Robinhood Announces Data Security Incident (Update), Robinhood
The unauthorized party socially engineered a customer support employee by phone and obtained access to certain customer support systems.
Supports data-breach for a stock trading app: the broker's own incident report says an attacker reached customer names and emails through the support tooling, so support-side access to brokerage accounts is part of the attack surface.
published 2021-11-16 · verified 2026-10-07
ev-0189regulatorprimary
FDA Informs Patients, Providers and Manufacturers About Potential Cybersecurity Vulnerabilities in Certain Medical Devices with Bluetooth Low Energy, U.S. Food and Drug Administration
These cybersecurity vulnerabilities may allow an unauthorized user to wirelessly crash the device, stop it from working, or access device functions normally only available to the authorized user.
FDA states the Bluetooth Low Energy flaws also reach consumer wearables, the radio link every companion app pairs over, so unauthorised pairing and device crashes are risks of this product type.
published 2020-03-03 · verified 2026-10-07
ev-0203post-mortemprimary
Details about the event-stream incident, npm
The injected code targets the Copay application.
Registry operator incident report: a new maintainer handed control of a widely installed package added a dependency carrying code aimed at one downstream build. Supports fraud-abuse for command-line tools whose install pulls third-party packages. The package was a library pulled into other projects' builds through their dependency tree, so it supports data-breach for an SDK whose transitive dependencies reach host app builds.
published undated · verified 2026-10-07
ev-0218regulatorprimary
Operators of AshleyMadison.com Settle FTC, State Charges Resulting From 2015 Data Breach that Exposed [amount]Users' Profile Information, Federal Trade Commission
Supports data-breach for a dating app: intruders took member profile data after weak access controls went unmonitored, and a paid full-delete option left member data in place. The order also covers fake profiles.
published 2016-12-14 · verified 2026-10-07
ev-0221regulatorprimary
FTC Requires Zoom to Enhance its Security Practices as Part of Settlement, Federal Trade Commission
The FTC also alleged that the company compromised the security of some users when it secretly installed software, called a ZoomOpener web server, as part of a manual update for its Mac desktop application in July 2018.
Regulator order: a Mac desktop app update installed a hidden local web server that bypassed a browser safeguard, stayed after the app was deleted and could reinstall it. The order also states the company advertised end-to-end encryption it did not provide and said cloud recordings were encrypted when some were stored unencrypted on its servers before transfer. Supports regulatory-penalty and data-breach for desktop applications and video conferencing tools.
published 2020-11-09 · verified 2026-10-07
ev-0222post-mortemprimary
Response to Video-On Concern, Zoom
Official company response: the vendor removed the local web server from its Mac client and added a full uninstall option after a researcher raised security concerns about the Mac client. Supports data-breach for desktop applications that open local ports.
published 2019-07-08 · verified 2026-10-07
ev-0227post-mortemprimary
Information About a Recent Mailchimp Security Incident, Mailchimp
The unauthorized actor conducted a social engineering attack on Mailchimp employees and contractors, and obtained access to select Mailchimp accounts using employee credentials compromised in that attack.
Official incident notice from an email marketing platform: staff credentials taken by social engineering opened customer accounts. Supports data-breach for email marketing platforms through internal support access.
published undated · verified 2026-10-07
ev-0228post-mortemprimary
Information About a Recent Security Incident Targeting Crypto Companies, Mailchimp
Official incident notice: an attacker reached an internal tool used for customer support and account administration through social engineering of staff and accessed customer accounts. Second incident of the same path, supports data-breach for email marketing platforms.
published undated · verified 2026-10-07
ev-0231post-mortemsecondary
Oracle E-Business Suite Zero-Day Exploited in Widespread Extortion Campaign, Google Threat Intelligence Group (Mandiant)
Threat intelligence write-up: an extortion group exploited a vulnerability in an ERP suite and sent executives file listings from victim ERP environments as proof of theft. Supports data-breach for ERP systems with internet-facing components.
published 2025-10-10 · verified 2026-10-07
ev-0232regulatorprimary
CISA Adds Seven Known Exploited Vulnerabilities to Catalog, CISA
These types of vulnerabilities are frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.
Regulator alert listing an Oracle E-Business Suite vulnerability as known to be exploited. Supports data-breach for ERP systems and the need to track patch level per module.
published 2025-10-06 · verified 2026-10-07
ev-0239regulatorprimary
ICS Advisory ICSA-22-200-01: MiCODUS MV720 GPS tracker (Update A), Cybersecurity and Infrastructure Security Agency (CISA)
Successful exploitation of these vulnerabilities could allow an attacker control over any MV720 GPS tracker, granting access to location, routes, fuel cutoff commands, and the disarming of various features (e.g., alarms).
CISA reports a vehicle GPS tracker whose API accepted a hard-coded master password and unauthenticated commands and, on a web server endpoint, arbitrary device IDs without further verification, exposing location and routes and allowing fuel cut-off, the core functions of fleet telematics.
published 2022-07-19 · verified 2026-10-07
ev-0244post-mortemprimary
Unauthorized Access to Okta's Support Case Management System: Root Cause and Remediation, Okta
Some of these files were HAR files that contained session tokens which could in turn be used for session hijacking attacks.
Official post-mortem: an attacker read files customers had attached to cases in the company's support case system, and browser HAR files in those cases held live session tokens. Supports data-breach for helpdesk software through ticket attachments.
published 2023-11-03 · verified 2026-10-07
ev-0245post-mortemprimary
Tracking Unauthorized Access to Okta's Support System, Okta
Okta recommends sanitizing all credentials and cookies/session tokens within a HAR file before sharing it.
Official incident notice: files uploaded to support cases were accessed, and the company tells customers to strip cookies and tokens from HAR files before attaching them. Supports data-breach for helpdesk software that accepts diagnostic file uploads.
published 2023-10-20 · verified 2026-10-07
ev-0249post-mortemprimary
Okta's Investigation of the January 2022 Compromise, Okta
Official investigation update: the workstation of a support engineer at a contracted sub-processor was compromised, and screenshots of internal support tools were published. Supports data-breach for identity providers whose outsourced support staff can act on customer tenants.
published 2022-03-24 · verified 2026-10-07
ev-0253regulatorprimary
FTC Says Ring Employees Illegally Surveilled Customers, Failed to Stop Hackers from Taking Control of Users' Cameras, U.S. Federal Trade Commission
Credential stuffing involves the use of credentials, such as usernames and passwords, obtained from a consumer’s breached account to gain access to a consumer’s other accounts.
The FTC charged a home camera company whose accounts were taken over by credential stuffing and brute force, after which attackers watched video and used two-way audio to harass people, including children, in their homes.
published 2023-05-31 · verified 2026-10-07
ev-0254regulatorprimary
Marketer of Internet-Connected Home Security Video Cameras Settles FTC Charges It Failed to Protect Consumers' Privacy, U.S. Federal Trade Commission
In addition, the FTC alleged that TRENDnet’s mobile applications for the cameras stored consumers’ login information in clear, readable text on their mobile devices.
An FTC order against a home camera maker cites the companion phone app storing login data in clear text, which is the app side of a connected-device product.
published 2013-09-04 · verified 2026-10-07
ev-0255regulatorprimary
D-Link Agrees to Make Security Enhancements to Settle FTC Litigation, U.S. Federal Trade Commission
The FTC settlement with a router and camera maker cites hard-coded device credentials and mobile app login data stored in clear text, and requires testing for vulnerabilities before release and automatic firmware updates.
published 2019-07-02 · verified 2026-10-07
ev-0262court-or-fineprimary
Apitor (FTC case), Federal Trade Commission
The FTC reached a settlement with Apitor Technology over allegations that its app enabled a third party in China to collect geolocation information from children without parental consent.
Supports regulatory-penalty and data-breach for a kids app: the companion app of a children's toy let a third party collect children's location without parental consent.
published undated · verified 2026-10-07
ev-0269regulatorprimary
Artificial intelligence: stop to ChatGPT by the Italian SA, Garante per la protezione dei dati personali
A data breach affecting ChatGPT users’ conversations and information on payments by subscribers to the service had been reported on 20 March.
The Italian data protection authority limited a chat assistant over a breach of user conversations, no legal basis for training on personal data, inaccurate personal data in answers and no age check for children.
published 2023-03-31 · verified 2026-10-07
ev-0273standardprimary
LLM02:2025 Sensitive Information Disclosure, OWASP Gen AI Security Project
The OWASP entry lists personal data, credentials and confidential business data exposed through LLM application output as a top risk for assistants.
published undated · verified 2026-10-07
ev-0316regulatorprimary
Reported Supply Chain Compromise Affecting XZ Utils Data Compression Library, CVE-2024-3094, CISA
The malicious code may allow unauthorized access to affected systems.
Government alert: malicious code was embedded in released versions of a compression library, and users were told to downgrade. Supports data-breach for libraries distributed to other developers' systems.
published 2024-03-29 · verified 2026-10-07
ev-0317post-mortemprimary
Security Update, Meta (Facebook Newsroom)
This allowed them to steal Facebook access tokens which they could then use to take over people’s accounts.
The company's own incident report says a flaw in the "View As" profile preview let attackers steal session tokens and take over accounts, a failure specific to social profile features.
published 2018-09-28 · verified 2026-10-07
ev-0322post-mortemprimary
Zoom's Use of Facebook's SDK in iOS Client, Zoom
Official company statement: a social login SDK in the iOS meeting client was collecting device information, and the company removed it and moved that login to the browser. Supports data-breach for video conferencing clients that embed third-party SDKs.
published 2020-03-27 · verified 2026-10-07