T-Mobile API abuse exposed data from 37 million customers.
Attackers accessed customer information by abusing an application programming interface without compromising T-Mobile's network.
Attackers abused an Authy API to identify millions of users.
An unsecured API endpoint was used at scale to verify phone numbers associated with Authy accounts.
A forgotten API was blamed for the massive Optus data breach.
An old internet-facing API remained online with broken access controls, exposing customer information for years.
Modern applications are exposing more than ever.
From exposed and forgotten APIs to AI credentials and connected tools, the API attack surface keeps expanding.
Shadow APIs remain an overlooked security risk.
Undocumented, outdated and unmanaged endpoints can remain outside the security team's view while still being reachable.
AI startup Braintrust told customers to rotate API keys after a breach.
A compromised cloud account contained customer API keys used to access cloud-based AI models.
Flaws in Anthropic's Git MCP server exposed a new AI attack surface.
Vulnerabilities could be chained across connected MCP tools to access files, overwrite data and execute malicious code.
A breach is not just a security event.
The global average cost of a data breach reached a record $4.99 million in 2026, driven in part by detection, escalation and lost-business costs.
Traditional tools protect pieces of the stack.
WAFs, gateways, documentation and inventories all matter. But each sees a different piece of the API environment.
organizations reported a breach involving AI-powered applications.
Connected APIs were among the recurring points of exposure.
Get Started Now
Ramkin helps security teams discover the APIs running across their environment and understand where sensitive data flows.