Express exposed customers' names, addresses, phone numbers, emails, and partial payment card details through a web vulnerability that allowed anyone to view other people's order confirmation pages by tweaking the URL — at least a dozen orders were indexed in Google search results. TechCrunch discovered the flaw through a security researcher and alerted the company, which patched it Wednesday but refused to say whether it would notify affected customers or file required breach disclosures with state authorities. This joins a pattern of major retailers leaving sensitive data exposed in recent months including Home Depot and Petco, suggesting companies are either slow to discover these vulnerabilities or reluctant to implement standard security practices like vulnerability disclosure programs.