Remember "He Went to Jared" Commercial - Here is an add-on "And he could access other orders by changing a link in his confirmation email".

A  bug was discovered and reported by a Jared customer who learned he could access other shoppers' orders by altering a link in his confirmation email and pasting the link into his browser. It was a small change, the report states, but it led him to orders containing peoples' names, billing and shipping addresses, phone numbers, email addresses, items and amount purchased, delivery date, tracking link, and the last four digits of the credit card used

“Being a Web developer, the only thing I can chalk this up to is complete incompetence, and being very lazy and indifferent to your customers’ data,” he said. “This isn’t novel stuff, it’s basic Web site security.”

https://krebsonsecurity.com/2018/12/jared-kay-jewelers-parent-fixes-data-leak/