It's 2024 and the API Breaches Keep Coming

APIs are built expressly to share a company’s most valuable data and services. This makes them a lucrative target for bad actors. We’ve already hit the tipping point — APIs are now THE way in. Salt Security’s 2024 State of API Security Report revealed that the count of APIs is increasing, having gone up by 167% in the past year. 95% of respondents have experienced security problems in production APIs, with 23% having experienced a breach. And, despite growing API traffic, only 7.5% of organizations have implemented dedicated API testing and threat modeling programs.

Here are some major API security breaches from 2024 that underscore the critical importance of securing APIs effectively:

1. Sensitive Messages Breach (January 2024): A buggy API led to unauthorized access to 650,000 sensitive messages, exposing passwords and allowing penetration testers to retrieve confidential data. This breach shows how even a single API flaw can compromise highly sensitive information​.

2. Trello Breach (January 2024): An exposed Trello API compromised data of over 15 million users by linking private email addresses to Trello accounts. This breach highlights the dangers of poor API security leading to millions of compromised data profiles​.

3. Spoutible Data Leak (February 2024): An API vulnerability in Spoutible exposed user data, including bcrypt hashes of passwords. This incident demonstrates the risks of insufficient API security in social media platforms​.

4. GitHub Repository Secrets Spill (March 2024): A breach exposed nearly 13 million API secrets through public GitHub repositories. Companies were left vulnerable as attackers exploited these credentials to gain unauthorized access​.

5. PandaBuy Data Leak (April 2024): Critical vulnerabilities in PandaBuy's API resulted in the theft of data affecting 1.3 million users. This breach emphasizes the need for strong API access controls to prevent unauthorized access​.