> In January 2024, data was scraped from Trello and posted for sale on a popular hacking forum. Containing over 15M email addresses, names and usernames, the data was obtained by enumerating a publicly accessible resource using email addresses from previous breach corpuses. Trello advised that no unauthorised access had occurred.
they'll argue it isn't a hack then, intentionally public endpoint
To be able to support that most apps do it as first step is ask for an email to be able to redirect them to the right flow. So the problem is bootstrapping how does a user confirm it's him before he can login to the right system.
Most B2B apps are forced to deal with this because there's no one protocol here, and different paying customers have different internal systems. Asking the user to choose from a dropdown of 20+ paths is proving to be impossible of the extremely high customer support costs.
It's a cycle of misery
I think the email was misleading saying that your trello was pwned.