A Blackstone real estate company exposed SSN digits, DOBs, addresses and more

Aug 24, 2026 11:29 PM - 3 weeks ago 3

Beam Living sign-up and sign-in screen

Finding lodging successful NYC is hard. Everyone knows that. But what not everyone knows is that it is easier to find the past 4 digits of someone’s Social Security number than an apartment…

I was applying for a lease connected Beam Living, a Blackstone portfolio company. I went done the normal flows, but (as a security-conscious individual) I ever person my web tab unfastened arsenic I browse the web to make judge I americium not putting my delicate accusation into a website that a book kiddie (or GLM-5.2) could easy break into.

As I was submitting my Social Security number, I figured I should cheque retired the GraphQL (rip, utilized to beryllium the basking thing) queries that were processing it.

The GraphQL query

At first, I didn’t spot thing of note. But erstwhile I went to my main profile, I saw a telephone to pd-dlcore.beamliving.com/graphql pinch the payload:

Redacted Beam Living GraphQL interaction petition shown successful Chrome DevTools

View the afloat GraphQL query

query contact($contactId: String!) { contact(contactId: $contactId) { ...contactInfo __typename } } fragment contactInfo on ContactDtoModel { incomeVerificationMethod incomeCheckStatus incomeCheckReferenceId creditScore address applicationStatus city companyOrSchool consentDate consentIp country dateOfBirth emailAddress emergencyContact { emergencyContactEmail emergencyContactName emergencyContactPhone emergencyContactRelationship __typename } firstName id identityVerificationSubmittedDate incomeCheckDate isCurrentLeasee jobTitle lastName noSsn occupation pets { birthDay breed id isServiceDog licenseNumber name rabiesExpirationDate weight __typename } postalCode preferredName screeningFeePaid ssnInfo state status { ...applicationStatus __typename } telephone __typename } fragment applicationStatus on StatusDtoModel { applicationProgress { basicInfo { actionRequired __typename } dogsInformation { actionRequired __typename } emergencyContact { actionRequired __typename } identityVerification { actionRequired __typename } incomeVerification { actionRequired __typename } payments { actionRequired __typename } review { actionRequired __typename } __typename } progressDetails { applicationForm { description status __typename } firstMonthRent { description status __typename } identityVerification { description identityVerificationCompletedDate identityVerificationStatus identityVerificationSubmittedDate status __typename } incomeVerification { description status __typename } leaseGuarantee { description status __typename } leaseSigning { description signatureId status __typename } managerReview { managerReview managerReviewDecisionCode status __typename } securityDeposit { description paymentLink securityReplacement __typename } backgroundScreeningCheck { status __typename } creditCheck { status __typename } __typename } guestCardCreated unitReservationFailed __typename }

While not needfully bad, supplying a user’s email into a GraphQL query for illustration this, arsenic opposed to conscionable deriving it from the convention cookie, is ever a smell.

The evident test

So I did the evident point – I took a friend’s email (I knew he had besides utilized the service) and… boom. The past 4 digits of his Social Security number, day of birth, location address, IP address, telephone number, etc., etc.

Redacted Beam Living GraphQL consequence showing exposed SSN and applicant fields

The effect was not constricted to my exertion aliases my building. Beam Living utilized this leasing portal crossed its communities:

8 Spruce
StuyTown
Peter Cooper Village
Kips Bay Court
Parker Towers

Anyone who had applied done that shared portal—and whose grounds remained successful the system— had their Social Security number information, day of birth, location address, IP address, telephone number, and different exertion information accessible to immoderate 1 who knew their email address.

Disclosure and the silent patch

I instantly stopped testing and disclosed it to Beam Living. The disclosure process wasn’t perfect – I had to nonstop galore emails and yet sewage connected a telephone telephone pinch personification from the Beam Living team. They said they had checked and location was nary rumor astatine all. I went backmost to effort the utilization again and it had been silently patched. So I americium gladsome that the rumor is fixed, but this is not really companies (especially ones owned by giants for illustration Blackstone) should grip disclosure…

The disclosure timeline went for illustration this:

June 14: I emailed [email protected] to study a superior vulnerability exposing applicants’ and guarantors’ PII—including the past 4 digits of SSNs, in installments scores, dates of birth, addresses, and telephone numbers. I asked really to disclose this vulnerability responsibly.
June 16: After receiving nary reply, I followed up, emphasized the severity, and again asked Beam Living to corroborate the correct disclosure transmission aliases link maine pinch its information team. I received nary response.
June 23: I told my Beam Living leasing supplier that I had recovered a superior vulnerability exposing SSN digits, dates of birth, telephone numbers, addresses, and different applicant information done an email address. I asked to beryllium connected pinch the correct squad for responsible disclosure.
June 24: I followed up and warned that the vulnerability was still live. The leasing supplier said my study had been forwarded to a squad for investigation.
June 26–July 8: I continued trying to scope someone. On July 1 and again connected July 8, I explicitly warned that my data—and different users’ data—was still exposed.
July 9: After a telephone conversation, Beam Living’s Resident Experience squad asked maine to nonstop specifications truthful they could walk them to the Technology team. I retested instantly afterward and recovered that the rumor had yet been patched. I offered to coordinate disclosure and said I planned to people aft giving them clip to respond.
After July 9: I connected pinch Beam Living’s caput of Operations, who was very nice, and told her that I intended to disclose the vulnerability publicly.