Blackstone-owned Beam Living exposed applicant SSN digits
A security researcher applying for a lease on Beam Living, a residential leasing platform described in the source as a Blackstone portfolio company, kept the browser's network tab open while filling out the application, a habit from working in security. While submitting a Social Security number, the researcher noticed a GraphQL request to Beam Living's API for an operation named contact, which took nothing but an email address, labelled contactId, as its parameter and returned a full profile for that person: income verification method and status, credit score, address, application status, city, employer or school, consent date and IP address, country, date of birth, email, an emergency contact's name, email, phone and relationship, first and last name, an internal ID, identity-verification dates, occupation and job title, pet details down to breed and license number, postal code, screening-fee payment status, Social Security number information, state, telephone, and a full breakdown of the application's progress. The researcher's own assessment: supplying a user's email into a query like this, instead of deriving identity from the session cookie, is always a smell, even if not necessarily malicious by itself.
To confirm the flaw exposed real data and not just the researcher's own record, the researcher substituted a friend's email address, since the friend had also applied through Beam Living. The query returned the friend's actual data: the last four digits of his Social Security number, his date of birth, home address, IP address, and phone number, among other fields. The API performed no check that the requester was the applicant tied to that email address, so anyone who knew an applicant's or a guarantor's email could pull their full profile. The exposure was not limited to the researcher's own building: Beam Living runs the same shared leasing portal across five New York City properties, named in the source as 8 Spruce, StuyTown, Peter Cooper Village, Kips Bay Court, and Parker Towers. Anyone who had applied through that portal, and whose record was still in the system, was exposed. The researcher's June 14 disclosure email specifically flagged that guarantors were exposed too, including their credit scores, not just applicants.
The disclosure process itself became part of the story: the researcher describes it as not ideal, involving many emails and eventually a phone call with someone from the Beam Living team who said the company had checked and found no issue at all, only for a retest afterward to show the flaw had been silently patched (the source gives this account without a specific date). A dated timeline in the post lays out the same broader process: a first email on June 14 describing the vulnerability and asking how to disclose it responsibly, an unanswered follow-up on June 16, contact with the researcher's own Beam Living leasing agent on June 23, and, after a June 24 follow-up, word from that agent that the report had been forwarded to a team for investigation. The researcher kept trying to reach someone from June 26 through July 8, explicitly warning on both July 1 and July 8 that both their own and other users' data were still exposed. On July 9, a phone conversation with Beam Living's Resident Experience team led to a request for the researcher to send details to the company's Technology team; a retest immediately afterward showed the flaw had finally been patched, with no acknowledgment from Beam Living that it had ever existed. The researcher then connected with Beam Living's head of Operations and said they intended to publish the vulnerability report.
Key facts
- A GraphQL query named contact on Beam Living's API returned a lease applicant's full record, including Social Security digits and date of birth, given only that applicant's email address, with no check that the requester was the applicant.
- Beam Living, described in the source as a Blackstone portfolio company, ran the same vulnerable leasing portal across five New York City properties: 8 Spruce, StuyTown, Peter Cooper Village, Kips Bay Court, and Parker Towers.
- Exposed fields covered both applicants and guarantors, and included the last four digits of Social Security numbers, dates of birth, home addresses, IP addresses, phone numbers, and credit scores.
- The researcher first reported the bug on June 14 and got no substantive response until June 24, then kept warning through July 8, including on July 1, that the exposure was still live.
- By July 9, a retest confirmed Beam Living had silently patched the flaw, after a company representative had told the researcher by phone that there was no issue; the source describes no public disclosure or notice to affected applicants.
Why it matters
The flaw is a textbook broken-authorization bug: a GraphQL operation named contact took only a client-supplied email address and returned that person's entire application record, with nothing tying the request to the session of whoever was actually logged in. Finding it required no special tooling, just the browser's built-in network inspector, open while filling out a routine rental application. It hit Beam Living, described in the source as a Blackstone portfolio company, and the exposed fields (Social Security digits, date of birth, address, phone number, credit score, emergency-contact details) are exactly the data used for identity theft and account takeover. The episode is as much a story about disclosure practice as about the bug itself: the researcher describes weeks of unanswered emails, a phone call in which a company representative said there was no problem, and a fix that arrived with no public acknowledgment.
Who it affects
Anyone who submitted a lease application, or was listed as a guarantor on one, through Beam Living's shared leasing portal, provided their record was still in the system: exposure needed only that someone else know their email address. The source names five affected New York City properties that used the same portal (8 Spruce, StuyTown, Peter Cooper Village, Kips Bay Court, and Parker Towers). On the company side, Beam Living operates the portal and Blackstone owns Beam Living; the source does not say whether either company issued a public notice to affected applicants.
How to use it
There is no product, price or signup involved here; the closest practical takeaway in the source is the researcher's own diagnostic rule: when a GraphQL query accepts a client-supplied identifier, such as an email address, to look up a record instead of deriving identity from the authenticated session, that is worth checking, and it can be checked the same way this bug was found, by watching the browser's network tab while using the site normally. The source does not describe Beam Living notifying affected applicants or offering them any specific action to take.
How solid is it
This is a first-person account from the researcher who found, personally tested and reported the bug, illustrated with the actual GraphQL query and response schema captured from the network tab, plus a dated email and phone timeline (though none of the timeline's dates carry a year). The researcher validated the exposure on a second real record, a friend's, knowing the friend had also used the service, rather than relying on the researcher's own data alone. The one quoted response from Beam Living's side, relayed secondhand, is a phone call in which a representative said the company had checked and found no issue, a claim the researcher says a retest contradicted; no on-the-record statement from Beam Living or Blackstone is quoted. The post says it drew attention on Hacker News, where at the time of writing it had 87 points and 28 comments, but it has not been corroborated by a separate outlet.
Risks and caveats
The exposed Social Security data was limited to the last four digits, not the full number, though combined with a date of birth, home address and phone number that is still enough for identity theft or social-engineering risk. The source does not say how long the flaw existed before it was found, how many applicants' records were actually queried by anyone other than the researcher and the one friend used to confirm the bug, or whether Beam Living notified affected applicants or published a security advisory. The account of the phone call in which a Beam Living representative said there was no issue is not tied to a specific date, so its place relative to the June and July timeline is unclear. No individual at Beam Living is named in the source; the leasing agent, the phone contact, the Resident Experience team and the head of Operations are identified only by role. The researcher, who remains an applicant relying on Beam Living for housing, flagged the personal risk of publishing this account while still going through that process.
“While not necessarily bad, supplying a user's email into a GraphQL query like this, as opposed to just deriving it from the session cookie, is always a smell.”
— the researcher who found and disclosed the flaw