This looks distressingly similar to https://blog.zulip.com/2021/03/20/zulip-cloud-security-incident/ https://blog.zulip.com/2021/03/20/zulip-cloud-security-inci

This looks distressingly similar to https://blog.zulip.com/2021/03/20/zulip-cloud-security-incident/ https://blog.zulip.com/2021/03/20/zulip-cloud-security-incid... . Klarna: Our app is configured specifically to avoid inadvertent caching through the use of cache control directives found in the HTTP standard (no-cache, no-store, must-revalidate). However, the CDN configuration can at times override the app configuration. Zulip: Zulip separately marks its responses as non-cacheable, both to prevent private data from being sent to the wrong user, and also to prevent stale data from being sent even to the right user. Indicating that a response is not cacheable is the purpose of Zulip’s Cache-Control header: max-age=0 [...] no-cache [...] no-store [...] must-revalidate [...] private [...] CloudFront usually respects the Cache-Control and Expires headers, but with one critical exception when receiving multiple similar requests at roughly the same time It looks like Klarna's main website uses CloudFront, so I bet this was the exact same thing.