Moonpig API vulnerability exposed data of 3M customers for 17 months
Context & Ripple Effects
Moonpig is the latest entry in a 2015 pattern of consumer services shipping customer-data APIs with no real access control: weeks after this report, [[a:838068|Target's mobile wish-list app was found exposing sensitive personal data through an API that lacked authentication]]. The arc extends forward too — three years later the USPS patched a flaw that let anyone with a usps.com account view details of 60M users, again long after a researcher disclosed it.
What makes the Moonpig case notable within that set is duration: 3M customers' details sat exposed for 17 months through a single API endpoint, putting it in the same camp as Volkswagen's vendor lapse that spanned 2014 to 2019.
First-order effects
- Roughly 3M Moonpig customers have had personal data reachable via an open API endpoint for over a year and a half, and the company now faces remediation, notification, and questions about why researcher disclosures didn't trigger a faster fix.
Second-order effects
- Every greeting-card and gifting platform with a public mobile or partner API becomes an obvious target for the same class of probing, since Moonpig and the USPS flaw both show that authenticated-user interfaces can hide wide-open backend endpoints.
Third-order effects
- If the gap between researcher disclosure and fix keeps running to months or years — 17 months at Moonpig, over a year at USPS — pressure will build for mandatory disclosure timelines and routine third-party testing of customer-facing APIs, rather than relying on vendors' own security review.
The trend: Consumer web services keep exposing customer records through poorly secured APIs, and disclosure-to-fix lags measured in years are becoming the norm rather than the exception.