Probably not the best security in the world: Carlsberg wristbands spill visitor pics

The Carlsberg Experience allowed visitors to download photos and videos by entering wristband IDs that are easily derivable and brute-forceable; a researcher demonstrated enumerating many valid IDs (1 million in ~2 hours) and estimated roughly 13,000 visitors could be exposed every 30 days. Carlsberg's mitigation (rate limiting) appears ineffective and their response to the disclosure was significantly delayed, leaving personal data and GDPR compliance issues unresolved.