Trello suffered a data breach in January 2024 that resulted in the leak of more than 15 million user accounts. A threat actor used Trello’s insecure API to compromise millions of email addresses and users’ publicly available information. This massive data leak resulted in personal information being sold for next to nothing, raising security concerns.

Details of the Trello leak

In January 2024, a threat actor with the pseudonym ’emo’ claimed to have collected 15,115,516 email addresses used for Trello accounts. To collect this personal information, he fed more than 500 million email addresses into an unsecured API. The information obtained included email addresses, users’ public Trello account information and full names. About six months later, the same threat actor began selling this database on a hacking forum called Breached for just 8 site credits (about $2.32).

Trello initially claimed that there was no breach and said that the hacker had created the database from publicly available and scraped information. However, it later admitted that the incident was caused by an insecure API. Trello stated that thanks to its REST API, users could be invited with publicly available information via their email addresses.

However, as a result of the misuse of this API, a change was made to prevent unverified users from requesting other users’ public information. Only verified users will now be able to request another user’s public profile information through this API.

While collecting such public information may not seem dangerous at first glance, it can be used to create convincing phishing emails. Such attacks can lead to devastating security breaches such as password theft, malware distribution and more. Trello is a project management platform often used by businesses, allowing users to organize tasks into columns or cards. The platform claims to have more than 40 million users.