---
title: It took me less than an hour to reach 200,000 people's private data
author: Giacomo Balli
published: 2026-07-09
url: https://BigBalli.com/blog/it-took-me-less-than-an-hour-to-reach-200000-peoples-private-data
tags: Startups, Engineering, iOS, Product, Leadership
---

# It took me less than an hour to reach 200,000 people's private data

*By Giacomo Balli* | *Published: July 9, 2026*

It took me less than an hour to reach 200,000 people's private data (including mine) in an app I don't own. No password. No account. No login of any kind.

I reported it the right way and moved on. But it left me with a thought I couldn't shake, and it turned into the thing I now do for a living.

Here's how it started.

I'd been pulling apart an iOS app in a space I build in myself, just to understand how it was put together. Nothing exotic. I do this the way other people do crosswords.

Then I noticed the app hands every anonymous visitor a token before they log in or even create an account. So I took that token, pointed it at the data endpoint, and asked for the full user table.

It didn't ask who I was. It just started handing back people.

Names. Email addresses. Phone numbers. Physical locations. Account histories going back years. Not a sample. The whole table. Over 200,000 people, their private details readable by a complete stranger who never so much as installed the app.

I sat there for a second just staring at it. This is a real product, with real customers, run by people who are not careless.

Because here is the part that should scare every founder: the app itself was well built. Clean binary. No hardcoded secrets. Nothing a scanner would flag. Their developers are good at their jobs.

The hole wasn't in the code they wrote. It was in the gap between the app and the server, where the backend trusted a client it did not control and checked permission in the wrong place. You cannot see that by reading the code. You cannot see it with a scan. You only find it by asking the API the exact questions an attacker would ask, and watching what it gives up.

So I emailed the company privately, with the details and steps to reproduce. Responsible disclosure, no drama.

And then it made me realize most founders can't buy this. The exact thing that product needed, someone independent trying to break it before a real attacker does, is something almost nobody sells in a form a founder can actually purchase. No sales page. No fixed price. No clear deliverable. Just vague retainers and scanners that would have missed this entirely.

Most founders with a live product have never had anyone independent try to break it. Their developers are good. That is not the same as knowing what an outsider can actually do to the thing they built. And most people find out the hard way: a customer, an auditor, or a dead enterprise deal tells them first.

So I built the thing I wished I could have handed that company. One production app, assessed the way an attacker would. A memo the CEO can actually read, technical findings the developers can act on, and a retest to confirm the fixes held. Fixed price, real ending, no open-ended retainer.

If you ship software and nobody outside your team has ever tried to break it, one question is worth losing a little sleep over this week.

## What could someone actually do to us?

[Discuss on LinkedIn](https://www.linkedin.com/feed/update/urn:li:activity:7497473948163526656)

---

**Tags:** Startups, Engineering, iOS, Product, Leadership

---

*View the [HTML version](https://BigBalli.com/blog/it-took-me-less-than-an-hour-to-reach-200000-peoples-private-data) of this post.*