The Painted Turtle Data Breach (2015)

Misconfiguration would allow for possible disclosure of individual's data to people identified as a reference on an online application. The reference would also have to submit an application and if both were in 'pending' status they could view either by clicking a 'show related profiles' button.