An exposed Trello API allows linking private email addresses with Trello accounts, enabling the creation of millions of data profiles containing both public and private information.

A threat actor has released over 15 million email addresses associated with Trello accounts that were collected using an unsecured API in January.

Over 15 million Trello users now have their private email addresses associated with their Trello profiles exposed to the public. How did this happen?