A bug in an API endpoint was apparently abused to access customer data.