API Enumeration Flaw Exposes 1.6 M Customer Records at South African Cinema Chain
What Happened
In 2016 a legacy web API used by Ster‑Kinekor’s online portal contained an enumeration vulnerability that allowed attackers to harvest account data. The breach released 1,619,544 records, including unique email addresses, names, birth dates, genders, physical addresses, phone numbers, spoken languages, and plain‑text passwords.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the need for continuous control‑assurance over legacy APIs, including automated testing for enumeration and rate‑limiting gaps.
- Highlights the importance of strong credential protection (hashed + salted passwords) to satisfy data‑privacy regulations and audit evidence requirements.
- Shows how a documented incident‑response workflow and evidence‑preserving logs enable rapid breach notification and regulatory reporting.
Who Is Affected
- Cinema and entertainment operators with customer loyalty programs.
- Any organization that maintains legacy web applications exposing personal data.
- Third‑party service providers that integrate with such APIs (e.g., ticketing platforms, marketing tools).
Recommended Actions
- Conduct a comprehensive API inventory and apply automated security testing to detect enumeration or other input‑validation flaws.
- Enforce password security best practices: migrate plain‑text passwords to salted, iterated hashes and require password resets for affected users.
- Verify that continuous monitoring alerts on abnormal API request patterns and that logs are retained for forensic audit.
- Request a detailed incident‑response report from the vendor and update your risk register accordingly.
Technical Notes
- Attack vector: Unauthenticated enumeration of user identifiers via a vulnerable API endpoint.
- CVEs: None publicly assigned; vulnerability stems from insecure API design.
- Data types exposed: Dates of birth, email addresses, genders, names, passwords (plain text), phone numbers, physical addresses, spoken languages.
Source: https://haveibeenpwned.com/api/v3/breach/SterKinekor