API Security Testing: The Endpoints Nobody Remembered to Test

In September 2022, an attacker pulled the records of 9.5 million current and former Optus customers out of an API. According to the case Australia’s communications regulator later brought against the company, the vulnerable endpoint sat on a domain Optus no longer needed. A coding error had broken its access control in 2018.