Topic starter
20/08/2026 5:36 pm
TL;DR: 2025’s most damaging API incidents were driven by legacy endpoints, broken authorization, excessive data exposure, and exposed partner flows, according to Equixly’s analysis of five cases. The pattern shows that API governance now belongs in the same control conversation as identity, secrets, and lifecycle management, not as a separate engineering concern.
Editorial analysis by NHI Mgmt Group, based on content published by Equixly: “2025 Top 5 API Incidents”.
By the numbers:
- The McDonald’s / Paradox.ai incident exposed the personal information of approximately 64 million applicants.
Key questions
Q: What breaks when a public API is left outside the official inventory?
A: The control chain breaks at discovery, testing, and monitoring.
Q: Why do broken object-level authorization flaws create large-scale data exposure?
A: Because the API confirms the caller is signed in but fails to confirm the caller is allowed to access the specific object.
Q: What do teams get wrong about protecting internal APIs?
A: Teams often assume internal APIs are safe because they sit behind a restricted network or use relaxed authentication and authorization.
Practitioner guidance
- Implement continuous API inventory Map every production, partner, and legacy endpoint to an owner, authentication method, and retirement date, then remove or quarantine anything that is no longer in service.
- Enforce object-level authorization on every request Validate that the authenticated caller is entitled to the specific object, record, or tenant before returning data, especially where sequential IDs or predictable parameters exist.
- Harden third-party API assurance Require pre-production validation and ongoing reassessment for vendor-managed endpoints that handle applicant, customer, or employee data, with particular attention to BOLA and data exposure.
Bottom line: Unmanaged APIs become attack paths when inventory, retirement, and monitoring fall out of sync with application change.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:22 pm
API governance is now an access-control discipline, not just an engineering hygiene exercise. The incidents in this article show that authentication alone does not contain risk when object-level authorization, endpoint inventory, and decommissioning are weak. Once a legacy or undocumented endpoint is reachable, the access model itself becomes the security boundary. Practitioners should treat APIs as governed access paths, not passive integration plumbing.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Breaches involving third parties rose to 48% of all breaches, a 60% increase on the previous year, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
Q: How should organisations govern personal data flows across APIs under privacy law?
A: They should map every API that carries personal information, assign an accountable owner, and enforce disclosure, retention, and purpose limits at runtime. A privacy policy alone is not enough. Teams need lineage, logging, and control points that show where data moved, who could access it, and whether the transfer was lawful.
👉 Read our full editorial: API incidents in 2025 expose the cost of unmanaged endpoints