Ask HN: Real-life, ridiculous security incidents?
I discovered a SQL injection vulnerability in the credit card rewards site of a major US bank in 2011. A VP finally called me a day later and asked what I wanted — they thought I was a hacker trying to extort them, he told me they had been in meetings all day about it. They didn’t bother looking up my information to see that I had been an account holder for more than ten years.<p>The site was down for a few months while I assume they fixed and audited the whole product. They never told customers what happened.