13.5 million accounts reachable because the environment was configured to permit it. Nobody had to be clever.