Early versions of the Phoenix frameworks ORM would select every record if you didn't pass it an ID. I didn't know that and wrote a deletion endpoint forgetting to put said ID in. Tests passed (I mean it did delete...) and off to prod it went. Long story short: I deleted data for all our users. Thank God for backups.