Topic starter
19/08/2026 3:37 pm
TL;DR: API attacks surged in 2022, with Akamai reporting a 257% increase against financial services and incidents at Twitter, Optus, and T-Mobile showing how exposed interfaces can turn identity data into breach fuel, according to Pynt. For IAM and security teams, the lesson is that API security is also identity governance, because authentication, authorisation, and exposed test environments shape blast radius.
Editorial analysis by NHI Mgmt Group, based on content published by Pynt: “API Security Incidents in 2022: A Look Back”.
By the numbers:
- Akamai reported a 257% increase in web application and API attacks on financial service institutions in 2022.
Key questions
Q: What breaks when API authentication is correct but authorisation is weak?
A: Attackers can still read or modify data they should not reach, because identity was proven without proving entitlement.
Q: Why do exposed API keys and weak API controls create outsized breach risk?
A: Exposed API keys are powerful because they often grant direct access to applications, data, and automation paths without the friction of interactive login.
Q: What do security teams get wrong about test environments and APIs?
A: Teams often assume test networks are harmless because they are not customer-facing.
Practitioner guidance
- Tighten API authentication and request binding Require strong authentication on every API that returns identity-linked data, and verify that tokens, keys or sessions are scoped to the minimum readable attributes.
- Separate test networks from production identity data Block non-production environments from reaching live customer databases or production APIs, and validate that test access cannot cross trust boundaries.
- Reduce account lookup and enumeration risk Review endpoints that let a user submit an email address, phone number or other identifier and infer account existence or ownership, then remove unnecessary responses.
Bottom line: API incidents in 2022 showed that access control failures at the interface layer can expose identity data as efficiently as a direct breach of a customer system.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:17 pm
API security is now an identity governance problem, not a pure application problem. The article's incidents show that authentication and authorisation decisions at the API layer directly determine whether identity data can be enumerated or extracted. That puts API governance alongside IAM, because the API often becomes the practical enforcement point for who or what may touch account data.
A few things that frame the scale:
- Organisations that rely heavily on static credentials reported a 20-percentage-point increase in security incidents compared with those with low reliance, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should IAM teams govern APIs that expose personal data?
A: Treat those APIs as access pathways into identity data, not as simple integration points. IAM teams should define who or what can call them, what attributes may be returned, and whether the response reveals account existence or ownership. Governance has to cover authentication, authorisation, logging and response minimisation together.
👉 Read our full editorial: API security incidents exposed identity and access gaps in 2022