USPS patches API flaw that let anyone with a usps.com account view details of 60M users, over a year after a researcher says he disclosed the vulnerability
Brian Krebs / Krebs on Security :
Context & Ripple Effects
USPS has closed an authorization hole in a usps.com API that let any ordinary account holder pull details on 60 million other users — and the timing is the story: the researcher who found it says he reported it more than a year before the fix shipped. The delay echoes Moonpig's API vulnerability that sat exposed for 17 months and the Peloton API bug that went unpatched until a reporter contacted the company.
The pattern across this coverage is consistent: T-Mobile's staff-facing site leaked customer addresses and PINs to anyone with a phone number, Experian's site served full credit reports to strangers, and in each case the flaw was an API answering questions it should have refused. USPS is the largest government operator yet in that series, which makes its year-long remediation window the most consequential data point so far.
First-order effects
- Roughly 60 million people whose names and addresses were queryable through usps.com by any account holder are the affected population; the patch ends new lookups but does nothing about the year in which the data was reachable.
- USPS now owns a public record of sitting on a researcher's disclosure for over a year — Brian Krebs publishing it forced the fix timeline into the open.
Second-order effects
- Security researchers watching this case get fresh evidence that quiet disclosure stalls, strengthening the argument for going public or through the press first — exactly the route that moved Peloton off dead-center.
- Every organization running customer-facing APIs faces renewed pressure to audit object-level authorization checks, since the same class of flaw hit T-Mobile, Moonpig, Patreon, Peloton, and Experian before USPS.
Third-order effects
- If disclosure-to-patch gaps of a year or more keep recurring, regulators and standards bodies face growing justification to mandate disclosure-handling deadlines rather than relying on vendor goodwill.
- The recurring failure point is authorization logic, not encryption or perimeter defense — pushing security budgets and audits toward how APIs decide what each authenticated user may see.
The trend: API authorization flaws are becoming the dominant consumer-data exposure class, with slow vendor response to researcher disclosures turning individual bugs into a systemic accountability problem.