Notifications
Clear all
Topic starter
20/08/2026 5:36 pm
TL;DR: 2025’s most damaging API incidents were driven by legacy endpoints, broken authorization, excessive data exposure, and exposed partner flows, according to Equixly’s analysis of five cases. The pattern shows that API governance now belongs in the same control conversation as identity, secrets, and lifecycle management, not as a separate engineering concern.
NHIMG editorial — based on content published by Equixly: Blog Research 2025 Top 5 API Incidents
Questions worth separating out
Q: What breaks when legacy APIs are left online after they are no longer needed?
A: Legacy APIs usually break security first, not functionality.
Q: Why do exposed APIs so often lead to identity and data compromise?
A: Because APIs frequently return identity records, session material, and role data directly to the caller.
Q: How do security teams know if API authorisation is actually working?
A: They should test whether each identity can only complete the specific actions it is supposed to perform, then compare that result with runtime logs and anomaly patterns.
Practitioner guidance
- Build a complete API inventory Map all production, partner, deprecated, and undocumented endpoints, then assign ownership and retirement dates for anything that no longer has a business justification.
- Test object-level authorization on every sensitive endpoint Validate that changing an object ID, account ID, or tenant reference never returns data outside the caller’s entitlement, including in test and admin flows.
- Minimise response payloads and mask identity data Remove session tokens, backend metadata, and unneeded personal fields from API responses, and verify that direct API calls cannot recover them.
What's in the full article
Equixly's full blog research covers the operational detail this post intentionally leaves for the source:
- Step-by-step attack breakdowns for each of the five incidents, including request flows and response behaviour.
- Specific API flaws and proof points behind the Stripe, McDonald’s / Paradox.ai, Intel, Volkswagen, and Azure AD cases.
- The researchers’ observations on how each flaw could be tested or validated in practice.
- The article’s concluding remediation framing for teams that need to prioritise API discovery and testing.
👉 Read Equixly’s analysis of the five 2025 API incidents →
API shadow risk in 2025: what IAM and security teams missed?
Explore further
20/08/2026 6:22 pm
API governance is now an identity problem as much as an application problem. The article shows that exposed endpoints routinely carry credentials, session tokens, role data, and personal records. That means API assurance cannot sit only with developers or AppSec, because unmanaged API behaviour can directly undermine IAM, PAM, and NHI controls. Practitioners should treat API inventory and authorization as part of identity governance, not as an isolated technical review.
A few things that frame the scale:
- Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks, according to The 2024 ESG Report: Managing Non-Human Identities.
- Enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, showing how quickly one identity failure can compound, according to The 2024 ESG Report: Managing Non-Human Identities.
A question worth separating out:
Q: Who is accountable when an API exposes regulated data?
A: Accountability usually sits with the business owner, security owner, and operational owner together. For regulated environments, teams need clear assignment for inventory, change approval, incident escalation, and evidence retention. If no one owns the API lifecycle end to end, compliance and response both degrade quickly.
👉 Read our full editorial: API incidents in 2025 expose the cost of unmanaged endpoints
