Peter Thiel's Invite-Only Network Dialog Exposed Members' Personal Data via Misconfigured App Site
Dialog, an exclusive invite-only network founded by billionaire Peter Thiel, exposed the personal data of hundreds of high-profile members—including a NATO commander and US senators—through a misconfigured app distribution site that required no password to access.
Dialog, the exclusive invite-only network founded by billionaire investor and PayPal co-founder Peter Thiel, suffered a significant data exposure incident last week when personal information on hundreds of its high-profile members was left openly accessible on its app distribution site. The exposed data included dates of birth, emergency contacts, cell phone numbers, political leanings, internal rankings, and active login tokens for members that include a sitting NATO commander, two US senators, the US Treasury Secretary, a current White House intelligence official, and heads of national security policy at two leading AI firms. The site was set up to distribute a phone app for an upcoming gathering, and any visitor could sign up using any email address without a password.
After submitting an email, visitors landed on a near-empty holding page that reportedly loaded internal files on roughly 200 high-profile people directly into their browser. These files were visible using browser developer tools, which are built into every major browser. The forms were built using Fillout, a popular online form builder, and the data was stored in Airtable, a widely used cloud database platform. Fillout stated it was unaware of any compromise to its own systems and noted that customers are responsible for configuring their forms, connected data sources, and workflows.
Dialog's managing director described the access as a hack "executed by a well-known criminal who is wanted in the United States." However, WIRED, which broke the story, found no evidence that any break-in was required. The data was publicly accessible in plain HTML, requiring little more than clicking on a link on a web page. Dialog has not said when the misconfigured page first went live, meaning members' data could have been openly accessible for an indeterminate period before it was discovered.
The incident highlights the OWASP Top 10 #2 risk of security misconfiguration, which has risen from #5 in 2021. The category accounts for more than 719,000 documented security weaknesses. The fix is routine: build systems with only the features you need, and configure them securely. This case underscores how even organizations that pride themselves on exclusivity can fall victim to basic configuration errors.
How organizations describe incidents matters beyond a single breach. If simply accessing publicly available information is routinely labeled a "hack," security researchers may become more reluctant to investigate and responsibly disclose exposed systems, leaving misconfigurations undiscovered for longer. For end users, the lesson is older than the internet: if an organization collects your date of birth, emergency contacts, and a private score of how much you're worth to them, ask where that data lives. Any answer involving "our website" deserves a second question, and anything that stops at "we take your security very seriously" deserves further questioning.