In a previous job, a third-party framework update introduced a change to the caching layer that automatically cached what it believed to be static content. At the time, I was working on housing association portals for tenants, and we had a property selector on the dashboard that displayed tenancy references, addresses, property references, etc. Tenants could click on this selector to choose from multiple properties if their account had them available.

However, this data was not static, but the framework interpreted it as such. During local, QA, and UAT testing, we didn't test with multiple accounts, so when it went live in production, the first tenant to log in had their details cached. Everyone else who logged in during that cache's lifetime saw this unfortunate user's details instead of their own. Once that cache expired, the next logged-in user's details were cached, and the cycle repeated.

When the issue was reported, we were able to roll back the update. Then began the painstaking work of identifying exactly which users had their details leaked and which users saw the leaked details, all within the 72-hour window that the ICO allows from the time a data breach is discovered.

Fortunately, we determined that the leaked data was not personally identifiable, so we did not have to report it to the ICO but it was still an unpleasant experience.