Unprotected API Leaks Confidential Data of 33,000 Employee Records—BeVigil Raises the Alarm

**Executive summary:** BeVigil discovered unauthenticated API endpoints belonging to a major service provider that exposed sensitive data for more than 33,000 employees (PII, asset and project details); the report details attack risks such as unauthorized data access, continuous monitoring for follow-on attacks, and targeted phishing, and recommends immediate mitigations including enforcing authentication/authorization, encrypting data, monitoring API traffic, and rotating exposed credentials.