how it happened
- whoactorfake company account
- the gappartner portal APIno rate limit
- the result~49M customer recordsnames, addresses, orders
what everyone assumed
The reasonable belief about a gated system is that the gate is the control, and that requiring an approved account is enough to keep the data behind it private. It is how most access is reasoned about: decide who gets in, and the rest follows. What that leaves unexamined is what an approved account can do once it is inside, and how quickly an account can be obtained in the first place.
what happened
The account was easy to get. An actor registered as a fake company and was approved within about two days, with no real verification standing in the way. Behind the gate, the lookup behaved as designed but without limits: an API that returned a customer record for a given 7-digit service tag, and no rate limiting to notice the same source asking again and again. Starting in March 2024, a script generated service tags and submitted them at a pace reported around 5,000 requests a minute, for roughly three weeks, collecting names, physical addresses, and order details one record at a time.
step by step
- a fake company registers as a partnerApproved within about two days, with no real check.
- an API returns a record per service tagWith no rate limit on how often it can be asked.the assumption breaks here
- March 2024about 5,000 requests a minute for three weeksNames, addresses and order details, one record at a time.
- late April 2024the data is offered for saleAbout 49 million customers, purchases back to 2017.
how it surfaced
The scraping surfaced not through an alarm but through a sale: in late April 2024, the actor posted on a cybercrime forum offering data on about 49 million Dell customers. The records covered purchases going back to 2017. No password or payment data was taken; the loss was the slow, permitted harvest of everything the portal would answer for an approved account that nobody was rate-limiting.
A gate decides who comes in, not what they can carry out, and an interface that answers one safe-looking question will answer it millions of times if nothing is counting.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersA fake partner looks up order after order, all day, for weeks.what it costs youYour whole customer list leaves one permitted request at a time, and turns up for sale.
- or it goes like thisit happenedTrello, 2024howAn 'is this email registered' check is fed a huge list of addresses.what leavesa list of your users with nameswho ends up with itbuyers of breach data
- or it goes like thisit happenedTwilio Authy, 2024howA phone-number check is run against millions of numbers.what leaveswhich numbers belong to your userswho ends up with itpeople planning SIM swaps
sources
your turn
what you can do about it
this week
Look at how fast someone can get an account into one of your gated systems, and whether anything would notice a single account pulling far more data than a real user ever would.
You almost certainly run a portal, an API, or an export that is protected by login and then trusted to behave once someone is inside. The assumption to retire is that authentication is the whole defense, and that approved means safe. The Dell access was working as designed for three weeks; the design just never asked how much was too much.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →