A missing authentication check on a table query endpoint. One defect, and a different blast radius inside every tenant.
The factor held. Being known to use it became the attack surface.
Every record was already public. The endpoint added the one thing that was not: confirmation.
There was no exploit. The endpoint answered anyone who asked, because nothing asked who was calling.
For a pseudonymous account, a phone number is not contact data. It is the link to the person.