Data Leakage: How a Blackstone Subsidiary Exposed Sensitive Applicant PII

By Alex Schapiro | Published August 24, 2026

It is a strange irony of the modern world: finding the last four digits of a stranger's Social Security Number (SSN) is currently easier than finding a decent apartment. This realization hit me while I was applying for a lease through Beam Living, a company within the Blackstone portfolio.

As a security-conscious user, I maintain a habit of keeping my browser's network tab open. I want to ensure that my sensitive data isn't being transmitted to a site that some "hot new" GraphQL implementation or a script kiddie (or perhaps a GLM-5.2 model) could easily compromise.

The Technical Breakdown

While submitting my SSN, I decided to analyze the GraphQL queries handling the transaction. Upon visiting my profile, I noticed a request sent to pd-dlcore.beamliving.com/graphql.

The payload looked like this:

{ 
  "operationName": "contact", 
  "variables": { 
    "contactId": "[email protected]" 
  } 
}

The full query structure was as follows:

query contact ( $contactId : String ! ) { 
  contact ( contactId : $contactId ) { 
    ...contactInfo 
    __typename 
  } 
} 

fragment contactInfo on ContactDtoModel { 
  incomeVerificationMethod 
  incomeCheckStatus 
  incomeCheckReferenceId 
  creditScore 
  address 
  applicationStatus 
  city 
  companyOrSchool 
  consentDate 
  consentIp 
  country 
  dateOfBirth 
  emailAddress 
  emergencyContact { 
    emergencyContactEmail 
    emergencyContactName 
    emergencyContactPhone 
    emergencyContactRelationship 
    __typename 
  } 
  firstName 
  id 
  identityVerificationSubmittedDate 
  incomeCheckDate 
  isCurrentLeasee 
  jobTitle 
  lastName 
  noSsn 
  occupation 
  pets { 
    birthDay 
    breed 
    id 
    isServiceDog 
    licenseNumber 
    name 
    rabiesExpirationDate 
    weight 
    __typename 
  } 
  postalCode 
  preferredName 
  screeningFeePaid 
  ssnInfo 
  state 
  status { 
    ...applicationStatus 
    __typename 
  } 
  telephone 
  __typename 
} 

fragment applicationStatus on StatusDtoModel { 
  applicationProgress { 
    basicInfo { actionRequired __typename } 
    dogsInformation { actionRequired __typename } 
    emergencyContact { actionRequired __typename } 
    identityVerification { actionRequired __typename } 
    incomeVerification { actionRequired __typename } 
    payments { actionRequired __typename } 
    review { actionRequired __typename } 
    __typename 
  } 
  progressDetails { 
    applicationForm { description status __typename } 
    firstMonthRent { description status __typename } 
    identityVerification { 
      description 
      identityVerificationCompletedDate 
      identityVerificationStatus 
      identityVerificationSubmittedDate 
      status 
      __typename 
    } 
    incomeVerification { description status __typename } 
    leaseGuarantee { description status __typename } 
    leaseSigning { 
      description 
      signatureId 
      status 
      __typename 
    } 
    managerReview { 
      managerReview 
      managerReviewDecisionCode 
      status 
      __typename 
    } 
    securityDeposit { 
      description 
      paymentLink 
      securityReplacement 
      __typename 
    } 
    backgroundScreeningCheck { status __typename } 
    creditCheck { status __typename } 
    __typename 
  } 
  guestCardCreated 
  unitReservationFailed 
  __typename 
}

Security Note: Passing a user's email as a variable in a GraphQL query—rather than identifying the user via a secure session cookie—is a major "red flag" in API design.

The Exploit

The test was straightforward. I substituted my email with that of a friend who had also used the service. The result was an immediate data dump.

Mathematically, the vulnerability can be represented as: $\text{Request}(\text{Any\_Email}) \rightarrow \text{Full\_PII\_Response}$

Scope of the Exposure

This leasing portal was shared across several high-profile communities. Anyone who had applied through this system was potentially exposed:

• 8 Spruce
• StuyTown
• Peter Cooper Village
• Kips Bay Court
• Parker Towers

Leaked Data Categories

The Disclosure Struggle

Once I confirmed the flaw, I ceased testing and attempted to notify Beam Living. The process was frustratingly slow and lacked a professional security channel.

Timeline of Events

• June 14: Initial email sent to report PII exposure.
• June 16: Follow-up email sent; no response received.
• June 23: Informed a leasing agent about the vulnerability.
• June 24: Warned that the flaw was still live; agent claimed it was forwarded.
• July 1 & 8: Explicit warnings sent that my own data remained exposed.
• July 9: Phone call with Resident Experience team $\rightarrow$ details sent to Tech team $\rightarrow$ Patch applied.

Final Thoughts

While I am relieved the vulnerability is closed, the "silent patch" and the disjointed communication are disappointing. For a company backed by a giant like Blackstone, the lack of a structured vulnerability disclosure program is a significant oversight.

After the fix, I spoke with the head of Operations, who was professional and kind, but the initial handling of the report left much to be desired.