> I’m super curious how customers ended up seeing other people’s accounts. I don’t know anything about this particular case, but the usual cause of this is ove

> I’m super curious how customers ended up seeing other people’s accounts. I don’t know anything about this particular case, but the usual cause of this is over-zealous caching (usually by an intermediate load balancer or the like) that returns cached pages while ignoring the session data. The result is that one person logs in and gets their account info, and then everyone else who tries to view the same page gets that person’s info instead of their own. For example, this happened to Steam in 2015: https://arstechnica.com/gaming/2015/12/valve-explains-ddos-induced-caching-problem-led-to-xmas-day-steam-data-leaks-and-downtime/ https://arstechnica.com/gaming/2015/12/valve-explains-ddos-i... Of course, there are also other possibilities, but this is the most likely. Alternatives that come to mind (though I’ve never seen any of these actually happen): - A bad RNG creating the same session token for multiple users - Concurrency bug in the web server returning results to the wrong connection - Messed-up migration causing account IDs to be associated with the wrong credentials (maybe IDs from the old and new systems got mixed up)