Leaks are everywhere. I went to a certain country and needed to register my phone, somehow ended up in a workflow that allowed me to enter any national registration number (similar to a social security number) and it would output the person's name, phone number, address and other details for me to confirm that that was me :)

No rate limiting on the endpoint, doesn't require auth, didn't block my VPN, doesn't even set cookies (very privacy conscious devs apparently). I could have mined the entire country's data. Insane.