The ChatGPT Redis Bug: Cross-Tenant Leaks in One Line
A redis-py cancellation bug plus a disabled key-prefix let some ChatGPT users see strangers’ chat titles and billing data. Multi-tenant cache lessons.
Twitch Leak: 125GB of Source Code and Payouts on 4chan
No malware, no zero-day — one exposed internal endpoint handed over Twitch’s entire codebase and three years of creator earnings.
AT&T 73M Leak: The 2019 Dataset That Resurfaced Free
March 2024’s 73-million-record AT&T leak was an old wound reopened: a 2019-era vendor-workspace dataset, shopped unsuccessfully in 2021, finally dumped free on a hacking forum with SSNs and account details intact. This account disentangles it from the concurrent Snowflake campaign, explains why free publication maximizes criminal utility, maps the 7.6 million passcode resets, and follows the extortion thread that later surfaced in DOJ filings.
MOAB: The 26 Billion-Record Compilation That Wasn’t a Breach
The January 2024 ‘Mother of All Breaches’ headline turned out to be a compilation of thousands of prior incidents re-hosted in a misconfigured bucket — 26 billion rows of recycled credentials stacked into a credential-stuffing goldmine. This piece explains why aggregations are not new breaches but still multiply risk, how the 12-terabyte trove mapped to old LinkedIn, Adobe and MyFitnessPal leaks, and why password reuse makes every old breach a live 2024 attack.