“On the off chance we created an account – and to our surprise we were able to successfully log in with it.”
Germany and France gave away 30,000 free Interrail passes each, and the order backend kept issuing passes long after the form said they were gone. The same agencies, MCI and Caracal, built the EU’s DiscoverEU dashboard, where any self-registered account could read 245,971 registrations with names, emails and order numbers. Nobody listed a security contact, so the researchers emailed five organisations and got silence. Two governments and the European Commission signed off on this, and 18-year-olds paid with their data.