API testing firm APIsec exposed customer data during security lapse

Tech Crunch - Mar 31st, 2025

APIsec, a company specializing in API testing, recently confirmed a security lapse that resulted in an exposed internal database containing sensitive customer data. The unsecured database, which was accessible online for several days, stored records dating back to 2018, including customer employees' names and email addresses, as well as security posture details of APIsec's corporate clients. This exposure was discovered by security research firm UpGuard on March 5, who promptly notified APIsec. Although APIsec founder Faizel Lakhani initially described the data as non-sensitive "test data," further evidence revealed real-world customer data was involved, prompting APIsec to notify affected clients.

The significance of this incident lies in the potential for malicious use of the exposed data, which included technical information about client attack surfaces and API vulnerabilities. Such information could be exploited by adversaries to compromise client systems. The incident underscores the critical importance of securing APIs to prevent unauthorized access to sensitive data. The discovery also raises questions about APIsec's data management practices and compliance with data breach notification laws, as the company has yet to disclose if it plans to inform state attorneys general. This event highlights the ongoing challenges and stakes in cybersecurity, especially concerning third-party vendors entrusted with securing digital communications.

Cybersecurity Data Breach Ap Isec Up Guard Faizel Lakhani Api Security Fortune 500

Story submitted by Fairstory

RATING

7.4

Fair Story

Consider it well-founded

The article provides a comprehensive account of a significant data breach involving APIsec, highlighting both the company's response and the findings of UpGuard. It achieves a high level of accuracy by presenting verified facts and maintaining a balanced perspective through the inclusion of statements from both involved parties. The article is timely and addresses an issue of public interest, contributing to the ongoing discourse on cybersecurity and data privacy.

However, the article could be improved by incorporating additional perspectives from independent experts and affected customers, thereby enhancing its balance and source quality. The clarity and readability are strong, but further exploration of the technical aspects and potential policy implications could enrich the content. Overall, the article effectively informs readers about the incident while prompting consideration of broader cybersecurity challenges.

Accuracy

The article presents a factual account of a security lapse involving APIsec's exposed database. It accurately reports the timeline of events, including UpGuard's discovery of the leak and subsequent notification to APIsec. The story also captures the initial downplaying of the incident by APIsec's founder and the eventual acknowledgment of the exposure of real customer data. However, the article could benefit from additional verification of APIsec's claims about the nature of the data and the steps taken to notify affected customers. The mention of AWS keys and credentials adds complexity, and while the article reports these details, it does not confirm their current status, which could impact the overall accuracy.

Balance

The article provides a balanced view by presenting both APIsec's and UpGuard's perspectives. APIsec's initial response and subsequent acknowledgment of the issue are reported alongside UpGuard's findings, allowing readers to understand the situation from multiple angles. However, the article could include more perspectives, such as comments from affected customers or cybersecurity experts, to provide a fuller picture of the incident's implications and the industry's response to such breaches.

Clarity

The article is clearly written, with a logical flow that guides the reader through the sequence of events. It effectively uses straightforward language to explain technical concepts, such as APIs and security lapses, making the content accessible to a general audience. However, the article could be clearer about the technical details surrounding the AWS keys and credentials to avoid potential confusion among readers unfamiliar with cybersecurity terminology.

Source quality

The primary sources for the article are APIsec and UpGuard, both of which are directly involved in the incident. UpGuard, as a security research firm, provides credible insights into the nature of the exposed data. APIsec's comments are essential for understanding the company's response. However, the article could enhance source quality by including independent cybersecurity experts to validate the claims made by both parties and provide an unbiased assessment of the situation.

Transparency

The article is transparent in disclosing the timeline of events and the responses from APIsec and UpGuard. However, it lacks detailed explanations of the methodologies used by UpGuard to discover the breach and by APIsec to secure the database. Further transparency regarding the investigation process and the criteria for notifying affected customers would improve the article's transparency. Additionally, the article does not disclose any potential conflicts of interest that may affect the reporting.