Salt Security surveyed nearly 200 security, application, and DevOps professionals about their API concerns in February 2021. The results showed 91% of organizations involved in the survey suffered an API-related problem within the last year.
54% reported finding vulnerabilities in their APIs, 46% pointed to authentication issues, and 20% described problems caused by bots and data scraping tools.
For example, Peloton exposed data of its three million subscribers in 2021 due to a bug that allowed access to their private account data on Peloton’s servers even for private profiles.
The flaw allowed any Internet user to access subscribers’ personal information such as age, gender, location, birthday, and more.
This information was easy to retrieve and no special hacking tools were required—just knowledge of how to use a browser to query and modify data elements.