I once found a vulnerable API endpoint for a staffing company and ended up exporting their whole client database.
Reply on news.ycombinator.com