Personally Identifiable Information (PII) has been detected in API logs.
This indicates that the API is logging sensitive user data—such as names, email addresses, phone numbers, or government-issued identifiers—which could result in privacy violations or regulatory non-compliance.
Logging PII, even unintentionally, creates a significant security and compliance risk. APIs that log request/response payloads without sanitization may inadvertently store sensitive user information that is accessible to attackers, developers, or third-party services.
An attacker gains access to API logs through a misconfigured logging dashboard or compromised credentials.Within the logs, they find user-submitted form data containing full names, home addresses, and national ID numbers.This information is exfiltrated and sold, leading to identity theft and a reportable data breach.
