Records covering around 15 million Trello users were listed for sale on a criminal forum in January 2024. The data pairs email addresses with the public profile attached to each account — names, usernames and related profile fields.
Atlassian, which owns Trello, said there was no unauthorised access to its systems. A public API endpoint accepted an email address and returned the matching public profile, so a list of addresses obtained elsewhere could be turned into a list of confirmed accounts. The company subsequently required authentication to query profile information that way.
Nothing Was Breached, Which Is The Point
Every record returned was public by design. What the endpoint added was confirmation: it told the caller which addresses in a bought list were real Trello users, and attached a name to each one.
That turns a generic address dump into a targeted one. A phishing message that names the recipient and the product they use performs very differently from one that does not, and the company whose API supplied the pairing has suffered no intrusion to report.
Rate Limiting Is The Control That Was Missing
An endpoint answering one query at a time is a feature. The same endpoint answering fifteen million is a bulk export, and the only thing separating the two is a limit nobody set.
We have recorded the same pattern at Optus in 2022 and T-Mobile in 2023, both unauthenticated interfaces answering at volume. Where no credential is required there is no failed login to alert on, so the query count is the only signal available.
Compiled from public reporting and Atlassian’s statements, listed below. The 15 million figure originates with the seller and has not been confirmed by the company. Corrections: corrections@forensicpost.com.