[ABZeroCool]

MR SHAO (Peru) has a web page without proper authorization checks, so this allow to directly download customer data by simply manipulating the URL.

As a result of that, I am able to extract customer data that includes full name, home address, email and phone number, and also other irrelevant information as payment method, order status and order description.
I created two JSON files with information from all of the orders made this 2025, they both shows the whole information about the order (and if you want to, you can extract anything from 2024, 2023 and so on)

DETAILS OF THE LEAK

• Organization: MR SHAO
  
• Country: PERU
  
• File format: JSON
  
• # of affected customers: 836
  
• Endpoint: admin[.]mrshao[.]com[.]pe
  

SAMPLE:

LEAKED DATA DOWNLOAD LINK:

https://biteblob.com/Information/3261j2q...table.json
https://biteblob.com/Information/i4LZZui...etail.json

HACK THE PLANET!!!