A 16 year old boy hacked an internal Microsoft system called TITAN with 17 trillion records as it didn’t validate JWT signatures at all, accepted ‘admin’ as authentication without a password and was internet facing. They paid him $5000 and told nobody about it. https://blog.faav.net/how-i-couldve-accessed-17-trillion-microsoft-records