Topic starter
09/07/2026 3:20 pm
TL;DR: An alleged Polymarket exposure involving more than 10 million records and about 300,000 user-associated identities appears, based on current evidence, to stem from aggregation of public APIs and blockchain data rather than backend compromise, according to Gurucul. The incident shows how exposed metadata can still create privacy, profiling, and reconnaissance risk when identity signals are easy to correlate.
Editorial analysis by NHI Mgmt Group, based on content published by Gurucul: “Investigating the Alleged Polymarket Data Exposure”.
Key questions
Q: How should teams reduce risk from API endpoints tied to identity data?
A: Teams should inventory every API that can return account or profile data, then verify authentication strength, authorization scope, and whether the endpoint can return records in bulk.
Q: Why do public APIs create privacy risk even without a backend breach?
A: Because privacy risk comes from what can be assembled, not only what is stolen.
Q: What are the signs that API responses are enabling identity aggregation?
A: Look for repeated sequential requests, high-volume endpoint enumeration, unusual user-agent patterns, and request sets that focus on identity-like fields such as wallets, usernames, and activity markers.
Practitioner guidance
- Tighten public metadata minimisation Review every public API field for identity value, then remove, generalise, or delay any data that makes user correlation easier across systems.
- Rate-limit high-volume enumeration Set behavioural thresholds for sequential requests, repeated lookups, and bursty scraping patterns that indicate automated collection rather than normal use.
- Monitor for correlation-ready signals Watch for access patterns that combine wallet references, activity history, and profile attributes because those combinations are the raw material for identity aggregation.
Bottom line: The article describes an exposure pattern where public API and blockchain data can be aggregated into an identity dataset without confirmed internal compromise.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 3:38 pm
Public metadata is now part of the identity perimeter: When user, wallet, and behavioural data are exposed through APIs, the security boundary moves from backend systems to the structure of the response itself. That means identity governance must account for what an external party can infer from publicly accessible outputs, not only what a system protects internally. The practical conclusion is that data minimisation has become an identity control, not just a privacy preference.
A question worth separating out:
Q: What should security teams do when public metadata can be correlated across systems?
A: Treat correlatability as a governance issue and assign ownership for the public data surface. That means reviewing which fields become identifiers once joined externally, then deciding whether the platform should expose them at all, expose them more weakly, or monitor them more aggressively.
👉 Read our full editorial: Polymarket data exposure shows how public APIs enable identity aggregation