Worldwide enumeration of accounts was possible due to a —now closed— privacy vulnerability
Read in full here:
