Coding error in forgotten API blamed for massive data breach