It takes about three seconds. A logged-in customer looks at their own invoice online, notices the web address ends in a reference number, and out of curiosity changes that number by one. Suddenly they are looking at someone else’s invoice, complete with name, address, and order history. No password was guessed, no firewall was breached. […]
