“Akiri said he notified the Washington D.C. government in February about his findings, but received no response.”
Vermont’s pandemic unemployment site leaked names, Social Security numbers and bank account numbers to anyone without a login. DC Health hired a third party that declared it safe, until Krebs showed its CISO a live Social Security number pulled from the public site. Akiri contacted governments in January and February and got nothing. Salesforce says it is not a vulnerability, just a guest access default its customers keep getting wrong.