The Dell API Breach: It could have been prevented

The report reviews an incident where an attacker created a partner account and exploited a Dell partner-facing API and business-logic weakness to enumerate and harvest 49 million customer records by sending thousands of randomized seven-character service-tag queries per minute. The theft was enabled by lack of partner vetting, absent rate limiting and API monitoring; the report uses the case to illustrate API protection gaps and recommends using Salt's behavioral/ML-based API defense to detect and prevent similar scraping attacks.