[
  {
    "id": "api-real-001",
    "scenario": "Facebook API Data Breach (2019)",
    "instruction": "Analyze the Facebook API data breach.",
    "input": "Incident: Facebook API Data Breach\nDate: April 2019\nImpact: 533 million users\n\nBreach Details:\n\n1. Vulnerability:\n   - API endpoint exposed\n   - Contact importer feature\n   - No rate limiting\n   - Bulk data extraction\n\n2. Data Exposed:\n   - Phone numbers\n   - Full names\n   - Email addresses\n   - Location data\n   - Birthdates\n   - Bio information\n\n3. Technical Details:\n   - API: /api/graphql\n   - Method: Contact importer\n   - Technique: Scraping\n   - Duration: 2018-2019\n\n4. Attack Method:\n   - Automated scraping\n   - Phone number enumeration\n   - Profile data extraction\n   - Bulk data collection\n\n5. Impact:\n   - 533 million users affected\n   - 106 countries\n   - Data sold on dark web\n   - Used for phishing\n\nIndicators:\n- API: /api/graphql\n- Bulk requests\n- Phone enumeration\n- Profile scraping\n\nRemediation:\n1. Rate limiting\n2. API authentication\n3. Data minimization\n4. Monitoring\n5. User notification",
    "output": "## Facebook API Data Breach Analysis\n\n### Breach Summary\n- **Impact**: 533 million users\n- **Method**: API scraping\n- **Year**: 2019\n- **Data**: Phone numbers, emails\n\n### Vulnerability\n```\nAPI endpoint exposed\nContact importer feature\nNo rate limiting\nBulk data extraction\n```\n\n### Data Exposed\n```\nPhone numbers\nFull names\nEmail addresses\nLocation data\nBirthdates\nBio information\n```\n\n### Attack Method\n```\nAutomated scraping\nPhone number enumeration\nProfile data extraction\nBulk data collection\n```\n\n### Technical Details\n```\nAPI: /api/graphql\nMethod: Contact importer\nTechnique: Scraping\nDuration: 2018-2019\n```\n\n### Impact\n- 533 million users affected\n- 106 countries\n- Data sold on dark web\n- Used for phishing\n\n### MITRE ATT&CK Mapping\n- T1530: Data from Cloud Storage\n- T1213: Data from Information Repositories\n\n### Remediation\n1. Rate limiting\n2. API authentication\n3. Data minimization\n4. Monitoring\n5. User notification",
    "metadata": {
      "incident": "Facebook API Breach",
      "impact": "533 million users",
      "year": 2019,
      "category": "api-real"
    }
  },
  {
    "id": "api-real-002",
    "scenario": "Optus API Data Breach - Unauthenticated API (2022)",
    "instruction": "Analyze the Optus breach caused by an unauthenticated API endpoint.",
    "input": "Incident: Optus API breach\nDate: September 2022\nImpact: ~10 million customers\nCompany: Optus (Australia)\n\nAttack Vector:\n- Unauthenticated API endpoint\n- Simple enumeration of customer records\n- Weak access controls on API\n\nTechnical Details:\n\n1. Vulnerability:\n   - Publicly accessible API\n   - No authentication or authorization\n   - Excessive data returned per request\n\n2. Data Exposed:\n   - Names\n   - Dates of birth\n   - Addresses\n   - Driver license and passport numbers\n\n3. Root Cause:\n   - Missing API authentication\n   - Lack of rate limiting\n   - Poor data minimization\n\nTimeline:\n- Sep 2022: Unauthorized access detected\n- Sep 2022: Public disclosure\n- Oct 2022: Customer notifications and remediation\n\nIndicators:\n- High-volume API requests\n- Sequential customer ID queries\n- Large data responses\n\nRemediation:\n- Enforce authentication and authorization\n- Implement rate limiting\n- Reduce data exposure by default\n- Monitor API usage anomalies",
    "output": "## Optus API Breach Analysis\n\n### Incident Summary\n- **Company**: Optus\n- **Year**: 2022\n- **Vector**: Unauthenticated API\n- **Impact**: ~10 million customers\n\n### Root Cause\n```\nPublic API without auth\nOverexposed customer data\nNo rate limiting\n```\n\n### Impact\n- Identity document exposure\n- Increased fraud and identity theft risk\n- Regulatory investigations\n\n### Prevention\n1. Require strong API authentication\n2. Enforce least-privilege responses\n3. Apply rate limiting and anomaly detection\n4. Regular API security testing\n5. Centralized logging and alerts\n\n### MITRE ATT&CK Mapping\n- T1213: Data from Information Repositories\n- T1190: Exploit Public-Facing Application\n\n### References\n- Public Optus breach disclosures (Sep 2022)",
    "metadata": {
      "incident": "Optus API Breach",
      "year": 2022,
      "category": "api-real"
    }
  },
  {
    "id": "api-real-003",
    "scenario": "T-Mobile API Abuse - Customer Data Exposure (2023)",
    "instruction": "Analyze the T-Mobile customer data exposure caused by unauthorized API access.",
    "input": "Incident: T-Mobile API data exposure\nDate: January 2023\nImpact: 37 million accounts\nCompany: T-Mobile\n\nAttack Vector:\n- Unauthorized access to API\n- Data obtained without proper authorization checks\n- Exposed customer profile data\n\nTechnical Details:\n\n1. Exposure:\n   - Names\n   - Phone numbers\n   - Billing addresses\n   - Dates of birth\n\n2. Root Cause:\n   - Insufficient authorization checks\n   - Overly permissive API responses\n   - Limited anomaly detection\n\n3. Attack Method:\n   - Automated API queries\n   - Bulk extraction\n\nTimeline:\n- Jan 2023: Unauthorized access detected\n- Jan 2023: Public disclosure\n\nIndicators:\n- Unusual API request patterns\n- High request volumes from limited IPs\n- Repeated access to customer profile endpoints\n\nRemediation:\n- Strengthen authz checks\n- Implement rate limiting\n- Reduce data returned by default\n- Continuous monitoring",
    "output": "## T-Mobile API Exposure Analysis\n\n### Incident Summary\n- **Company**: T-Mobile\n- **Year**: 2023\n- **Vector**: Unauthorized API access\n- **Impact**: 37 million accounts\n\n### Root Cause\n```\nInsufficient authorization checks\nOverly permissive API responses\nLimited anomaly detection\n```\n\n### Impact\n- Customer PII exposure\n- Increased phishing risk\n- Regulatory scrutiny\n\n### Prevention\n1. Enforce strong authorization\n2. Minimize PII in responses\n3. Apply rate limiting and IP throttling\n4. Monitor for bulk extraction\n5. Regular API penetration testing\n\n### MITRE ATT&CK Mapping\n- T1213: Data from Information Repositories\n- T1078: Valid Accounts (API abuse)\n\n### References\n- T-Mobile public disclosures (Jan 2023)",
    "metadata": {
      "incident": "T-Mobile API Exposure",
      "year": 2023,
      "category": "api-real"
    }
  },
  {
    "id": "api-real-004",
    "scenario": "Peloton API Exposure - User Data (2021)",
    "instruction": "Analyze the Peloton API exposure that allowed access to user profile data.",
    "input": "Incident: Peloton API exposure\nDate: May 2021\nImpact: Millions of users\nCompany: Peloton\n\nAttack Vector:\n- API endpoint accessible without proper authorization\n- User IDs allowed access to profiles\n- Weak privacy controls\n\nTechnical Details:\n\n1. Data Exposed:\n   - User profile data\n   - Workout history\n   - Age and gender data\n\n2. Root Cause:\n   - Missing authz checks\n   - Overly permissive API\n   - Inadequate privacy defaults\n\nTimeline:\n- May 2021: Vulnerability reported\n- May 2021: Fix deployed\n\nIndicators:\n- Unusual access to user profile endpoints\n- Sequential ID enumeration\n- Large profile data responses\n\nRemediation:\n- Enforce authorization checks\n- Reduce data returned by default\n- Improve privacy settings\n- Monitor API access patterns",
    "output": "## Peloton API Exposure Analysis\n\n### Incident Summary\n- **Company**: Peloton\n- **Year**: 2021\n- **Vector**: Missing authorization checks\n- **Impact**: User profile data exposure\n\n### Root Cause\n```\nMissing API authorization\nOverexposed profile data\nWeak privacy defaults\n```\n\n### Impact\n- Privacy violations\n- Exposure of user activity data\n- Reputational damage\n\n### Prevention\n1. Enforce per-user authorization\n2. Minimize profile data exposure\n3. Secure privacy defaults\n4. Add rate limiting\n5. Continuous API security testing\n\n### MITRE ATT&CK Mapping\n- T1213: Data from Information Repositories\n- T1190: Exploit Public-Facing Application\n\n### References\n- Public Peloton vulnerability reports (May 2021)",
    "metadata": {
      "incident": "Peloton API Exposure",
      "year": 2021,
      "category": "api-real"
    }
  },
  {
    "id": "api-real-005",
    "scenario": "LinkedIn API Scraping - Mass Data Exposure (2021)",
    "instruction": "Analyze the LinkedIn scraping incident involving large-scale API abuse.",
    "input": "Incident: LinkedIn data scraping\nDate: 2021\nImpact: 700 million users (data scraped)\nCompany: LinkedIn\n\nAttack Vector:\n- Automated scraping of public profiles\n- API abuse and rate limit bypass\n- Large-scale data aggregation\n\nTechnical Details:\n\n1. Data Collected:\n   - Public profile details\n   - Email and phone data for some users\n   - Employment and education history\n\n2. Root Cause:\n   - Insufficient anti-scraping controls\n   - Rate limiting gaps\n   - Weak bot detection\n\nTimeline:\n- 2021: Data posted for sale online\n- 2021: LinkedIn investigates and confirms scraping\n\nIndicators:\n- High-volume profile requests\n- Automated user-agent patterns\n- Access from rotating IPs\n\nRemediation:\n- Strengthen bot detection\n- Improve rate limiting\n- Use risk-based access controls\n- Monitor for scraping patterns",
    "output": "## LinkedIn Scraping Analysis\n\n### Incident Summary\n- **Company**: LinkedIn\n- **Year**: 2021\n- **Vector**: API scraping and abuse\n- **Impact**: 700M profiles scraped\n\n### Root Cause\n```\nInsufficient anti-scraping controls\nRate limiting gaps\nWeak bot detection\n```\n\n### Impact\n- Large-scale data aggregation\n- Increased phishing and fraud risk\n- Reputational damage\n\n### Prevention\n1. Enhance bot detection and throttling\n2. Apply risk-based access controls\n3. Use anomaly detection on API traffic\n4. Minimize exposed profile data\n5. Monitor dark web data sales\n\n### MITRE ATT&CK Mapping\n- T1213: Data from Information Repositories\n- T1598: Phishing for Information (downstream risk)\n\n### References\n- Public reporting on LinkedIn scraping (2021)",
    "metadata": {
      "incident": "LinkedIn Scraping",
      "year": 2021,
      "category": "api-real"
    }
  }
]