Lack of standardization of the password reset procedures of web services can help hackers find the phone number linked to a victim’s email address. […]

from https://www.bleepingcomputer.com/news/security/phone-numbers-exposed-by-inconsistent-password-reset-processes/