Clothing Retailer Patches Website Flaw Exposing Customer Data

A security researcher discovered that Express’ order confirmation pages used sequential order IDs in URLs that could be tweaked to view other customers’ checkout data — including names, emails, phone numbers, postal addresses, order details and the last four digits of payment cards. Express confirmed and patched the issue after the researcher reported it via TechCrunch, but had not publicly notified affected users or fully answered disclosure questions.