GoKawiilBlackstone's Beam Living app leaked SSN digits and personal data via API bug
A security researcher applying for a lease on Beam Living, a Blackstone-owned property management platform, discovered that its GraphQL API returned sensitive applicant data including partial Social Security numbers, dates of birth, credit scores, addresses and emergency contact details. The information was exposed through a network call that could be inspected by anyone with basic developer tools while submitting a rental application.
GoKawiil's interpretation of the reporting above, not reported fact.
Rental applications require some of the most sensitive personal data people share online, and a poorly secured backend query like this could let attackers scrape SSN fragments, birthdates and financial details tied to real identities. The incident highlights how large real estate platforms backed by major financial firms can still ship insecure APIs that expose tenants to identity theft risk.
- Beam Living's GraphQL API exposed partial SSNs, birthdates, and addresses to anyone inspecting network traffic.
- The flaw was found by a security-conscious applicant simply monitoring browser dev tools during a routine lease application.
- The exposure raises concerns about data protection standards at large landlord platforms tied to major investment firms like Blackstone.
Fellowes Powershred 79Ci Paper Shredder — Stories like this are a reminder that your SSN, DOB and address end up on all kinds of paperwork — rental applications included. The Powershred 79Ci is a cross-cut shredder that turns lease packets, credit offers and old statements into confetti so at least the paper trail isn't a leak waiting to happen. It handles staples and credit cards too, making it an easy desk-side habit.
See Fellowes Powershred 79Ci Paper Shredder on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: alexschapiro.com — Alex Schapiro, 2026-08-24
Published there as: “A Blackstone real estate company exposed SSN digits, DOBs, addresses and more”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.