> series: anatomy_of_a_breach —— part: 019 —— target: att_ipad_users —— emails_exposed: 114,000 —— method: api_enumeration<span class="cursor-blink">_</span>_
In June 2010, security researchers from a group called Goatse Security discovered that AT&T's website contained an API endpoint that, when provided with the ICC-ID (Integrated Circuit Card Identifier) of an iPad 3G SIM card, would return the email address associated with that account. Since ICC-IDs followed a sequential numbering scheme, the researchers were able to enumerate approximately 114,000 email addresses of early iPad 3G adopters by iterating through ICC-ID values.
The exposed email addresses included those of White House Chief of Staff Rahm Emanuel, New York Mayor Michael Bloomberg, numerous military officials, media executives, and corporate leaders — essentially the early-adopter elite who had purchased the iPad within weeks of its launch. The incident was disclosed to AT&T, which patched the vulnerability, and to Gawker Media, which published the story. One of the researchers, Andrew Auernheimer (known as 'weev'), was subsequently convicted under the Computer Fraud and Abuse Act — a conviction later overturned on appeal — reigniting the debate about where security research ends and criminal activity begins.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallThe technical vulnerability was straightforward: AT&T had deployed an API endpoint that accepted an ICC-ID parameter and returned the associated email address. The API required no authentication — anyone who could guess or enumerate ICC-IDs could retrieve email addresses. Since ICC-IDs are sequential, enumeration was trivial.
This vulnerability class — insecure direct object reference (IDOR) combined with enumeration of sequential identifiers — is one of the most common findings in our API penetration testing engagements. It appears on the OWASP Top 10 and remains prevalent in modern APIs. The AT&T incident demonstrated its potential impact at scale — but the same vulnerability, discovered in a client's API during a penetration test, is remediated quietly without public disclosure.
In 2010, the iPad was new and APIs were less pervasive. In 2025, APIs are the backbone of every digital service — mobile apps, web platforms, IoT devices, and cloud services all communicate via APIs. The IDOR and enumeration vulnerabilities that exposed 114,000 AT&T customers now have the potential to expose millions. Our API penetration testing service tests for these vulnerability classes and more — authentication bypass, authorisation flaws, injection, rate limiting, and data exposure.
For organisations building or consuming APIs, our web application and API testing provides the security assurance that prevents your API from becoming the next breach headline. Cyber Essentials establishes baseline security. SOC in a Box monitors API traffic patterns. And UK Cyber Defence provides incident response when an API vulnerability is discovered or exploited.
Our <a href="/penetration-testing/api">API penetration testing</a> identifies IDOR, enumeration, authentication bypass, and data exposure vulnerabilities before attackers — or researchers — find them.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call