A weak link-generation algorithm exposed Democratic Party donor information in the NGP VAN service to attack last month. The vulnerability would allow an attacker to unsubscribe large volumes of donors from Democratic candidates’ fundraising emails, conduct phishing campaigns, or resell the data.I disclosed the vulnerability to NGP VAN’s engineering team, which patched the vulnerability within a week.In this talk, I propose to discuss my discovery process, the tools I used to exploit the vulnerability, and advice for email subscription management services to avoid similar problems.See the optional document section for links to blog posts describing what I'll be talking about.