Life Lock Bug Exposed Millions of Customer Email Addresses
Summary: LifeLock's website tied each customer account to a sequential numeric "subscriberkey" in its URLs, letting anyone with a browser enumerate records and pull down email addresses tied to millions of customer accounts, or unsubscribe users from all company communications. Security researcher Nathan Reese found the flaw after an unsubscribe link revealed his own key, wrote a proof-of-concept script, and stopped after enumerating about 70 emails; Symantec, which acquired LifeLock in November 2016 for $2.3 billion, took LifeLock.com offline shortly after KrebsOnSecurity contacted it.
What you should know: LifeLock's entire business is the promise of protecting identities, and its own site handed out a list of confirmed customers to anyone who could count - a ready-made target list for phishing that spoofs the brand, against a customer base of more than 4.5 million accounts.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026