Symphony Labs

symphonylabs.cc

17 October 2026 04:50

Obviously this was a massive failure on our part and we deeply apologize for it, we take full responsibility for our failure and we understand any and all customer disappointment in us for this grave error.

Symphony Labs

symphonylabs.cc

17 October 2026 04:50

The reason we have waited this long to bring this up is because we have paid for multiple security audits on our entire codebase from professionals and people in the DIY HRT community in order to ensure that this was fixed and that no mistakes like this happen in the future.

Symphony Labs

symphonylabs.cc

17 October 2026 04:50

To fix this, we have changed the system in which we do order tracking. We fixed the endpoint to remove this issue and now when tracking an order, a email and order number must be entered, and then the tracking number is emailed to the user.

Symphony Labs

symphonylabs.cc

17 October 2026 04:50

In short: there was an exploit related to our order tracking system that allowed an attacker to do a specific request on an API and get customer PII from it. Based off server logs, under 15 people were affected by this. Any and all users who had PII compromised have been emailed.

Symphony Labs

symphonylabs.cc

17 October 2026 04:50

Hi, We’re here to disclose a security vulnerability and give some information about who it affected, what happened, and how we have made sure that something like this won’t happen again. 🧵