Trello Allegedly Breached
Attackers have used Trello’s public “share/invite” functionality and API to enumerate more than 15 million accounts, matching already-leaked email addresses from other breaches to Trello names and usernames. Some observers argue this is a clear privacy leak and question why such an endpoint wasn’t better rate-limited or designed, while others frame it as credential enumeration rather than a traditional breach since no passwords or new emails were exposed. The incident has renewed criticism of Atlassian’s security practices, raised questions about the value of certifications like ISO 27001, and prompted calls for stronger personal hygiene such as unique or masked emails, non-reused passwords, and fake answers to security questions.
Nature of the incident
- Attackers used a Trello/Atlassian public API or “share/invite” feature that, given an email address, returns associated public profile info (name, username, sometimes bio).
- They fed this endpoint with large email lists from previous breaches and scraped matches for ~15M accounts.
- No passwords or internal data were reported; emails came from prior “breach corpuses,” and Trello claims no unauthorized access to internal systems.
Is this a breach or “just” enumeration?
- One side argues it’s not a breach:
- The endpoint is public and working as designed to support inviting users by email.
- Only already-known emails were used; emails themselves weren’t leaked by Trello.
- This is framed as credential stuffing / enumeration, not a compromise of Trello’s backend.
- Another side insists it is a leak:
- Input: email. Output: additional PII (name, username, account existence). That’s disclosure, regardless of intent.
- Lack of effective throttling or anomaly detection for millions of lookups is seen as a security failure.
- Comparisons are drawn to “designed” behaviors that would clearly be unacceptable in more sensitive domains (e.g., banking).
Are email addresses “personal information”?
- Some participants say yes: emails are classified as personal data in many orgs, can identify individuals, and enable phishing, spam, and profiling.
- Others view email as semi-public (e.g., work addresses, already widely leaked) and consider this a low-severity event.
- Consensus that Trello users will face more targeted phishing, though some feel they are already saturated with spam.
Regulation, notification, and certifications
- Questions raised about why notifications came via Have I Been Pwned rather than Trello; some suggest Trello doesn’t see this as a notifiable breach.
- GDPR breach-notification duties are mentioned, but posters note companies often wait to understand scope before announcing.
- ISO 27001 certification is criticized as “security theater,” given that a certified company can still allow large-scale enumeration.
User defenses and practices
- Strong emphasis on:
- Unique, random passwords and 2FA.
- Burner or masked emails per service (Apple Hide My Email, Firefox Relay, Fastmail aliases).
- Non-real or randomized answers to security questions.
- Freezing credit and minimizing disclosure of physical addresses where possible.