MovieBoxPro API Scrape Exposes Over 6 Million User Accounts
What Happened — In April 2024, attackers scraped more than 6 million email addresses and usernames from the streaming service MovieBoxPro after discovering a vulnerable public API endpoint. The service did not publicly disclose the breach, but the API was patched once the mass enumeration was identified.
Why It Matters for Trust & Control Assurance
- Continuous monitoring of API endpoints is a core control‑assurance activity; gaps allow attackers to harvest data at scale.
- Documented remediation and evidence of the fix provide a defensible audit trail for frameworks that require secure development and change‑management controls.
- Demonstrable oversight of third‑party services (the streaming platform) is essential for supply‑chain risk programs.
Who Is Affected — Media & entertainment streaming providers and the millions of end‑users whose credentials were exposed.
Recommended Actions
- Perform a focused API security assessment and remediate any insecure endpoints.
- Deploy continuous monitoring and logging of API traffic to detect anomalous enumeration activity.
- Capture and retain remediation evidence to satisfy audit‑readiness requirements across frameworks. Source: https://haveibeenpwned.com/api/v3/breach/MovieBoxPro
Technical Notes — The breach leveraged an unprotected API that allowed unauthenticated enumeration of user records. No CVE was published; exposed data consisted of email addresses and usernames. Source: https://haveibeenpwned.com/api/v3/breach/MovieBoxPro