Petco takes down Vetco website after exposing customers’ personal information

TechCrunch discovered an IDOR vulnerability on Petco’s Vetco Clinics customer portal that allowed unauthenticated access to downloadable PDF records (visit summaries, medical histories, prescriptions, vaccination records and customer PII). Sequential customer IDs meant records could be enumerated—potentially exposing millions of customers—and at least one file was indexed by Google; Petco has taken affected pages offline and said it is investigating.