USPS Site Exposed Data on 60 Million Users
Summary: The U.S. Postal Service fixed an authentication weakness in an API tied to its Informed Visibility program that let any logged-in usps.com user view account details for some 60 million other users, and in some cases request changes to their account details. The researcher who found the flaw said he reported it to USPS more than a year earlier without a response, and the API accepted wildcard search parameters that returned all records for a data set without searching for specific terms.
What's compelling: The exposed data included email addresses, usernames, account numbers, street addresses and phone numbers for roughly 60 million accounts, including some 13 million Informed Delivery users, and the API let any user convert regular usps.com accounts to Informed Visibility business accounts and vice versa.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026