SQL Injection as a Feature
https://idiallo.com/blog/sql-injection-as-a-feature
this was a SIAAS, most commonly known as SQL Injection As A Service. The entire database was exposed for anyone who had access to the service.
How did it happen? Well, with one request at a time over the span of 10 years.