Parler got owned. Badly. Whilst scrambling to keep operational as various server providers pulled Parler from their services the admins left open a security loophole that allowed hackers to create administration accounts. They used this to create MILLIONS of admin accounts and to start downloading all of the data that Parler had stored. Amongst this data, discussions planning to attack the US Capitol from verified users (with pictures of their drivers licences etc. ), GPS data, photos with EXIF data.
https://www.metafilter.com/189974/Parler-Games
Not true. It was even worse, like elementary school programming worse. per WIRED:
By Monday, rumors were circulating on Reddit and across social media that the mass disemboweling of Parler's data had been carried out by exploiting a security vulnerability in the site's two-factor authentication that allowed hackers to create "millions of accounts" with administrator privileges. The truth was far simpler: Parler lacked the most basic security measures that would have prevented the automated scraping of the site's data. It even ordered its posts by number in the site's URLs, so that anyone could have easily, programmatically downloaded the site's millions of posts.
Parler's cardinal security sin is known as an insecure direct object reference, says Kenneth White, codirector of the Open Crypto Audit Project, who looked at the code of the download tool @donk_enby posted online. An IDOR occurs when a hacker can simply guess the pattern an application uses to refer to its stored data. In this case, the posts on Parler were simply listed in chronological order: Increase a value in a Parler post url by one, and you'd get the next post that appeared on the site. Parler also doesn't require authentication to view public posts and doesn't use any sort of "rate limiting" that would cut off anyone accessing too many posts too quickly. Together with the IDOR issue, that meant that any hacker could write a simple script to reach out to Parler's web server and enumerate and download every message, photo, and video in the order they were posted.
