Cloud services are playing a crucial role to guarantee business continuity during this complicated period. SaaS applications and IaaS services have extended the corporate perimeter, allowing a nearly completely remote workforce to access their data from virtually any place.
Without considering the security implications for the endpoint (a topic that would deserve an entire blog post on its own), this process has revealed an increasingly common threat: the risk of misconfigurations leaking the data stored in the cloud to the entire planet. Poor security procedures, lax default settings, and also the mindset of too many users and administrators, which is still “on-premise“, are common causes of cloud leaks.
Over the last few years there have been multiple examples of leaky cloud services, exposing million of user records (with easily predictable consequences for the privacy of the unaware victims), or even fueling other attacks such in case of the two Magecart campaigns carried out compromising the AWSS3 buckets hosting the targeted sites’ configuration files.
And despite AWS S3 is the most common service to leak data, it’s not the only one, as you will notice. Last but not least, I will keep this list updated as soon as new cloud breaches will be revealed during 2021.
As always, thanks for sharing and supporting my work for spreading the risk awareness across the community. Also, don’t forget to follow @paulsparrows on Twitter, or even connect on Linkedin.
Nissan North America
The source code of mobile apps and internal tools developed and used by Nissan North America leakes online after the company misconfigured one of its Git servers.
Source code of mobile apps and internal tools
The data of 35 million users from Juspay goes on sales in the dark web
35 million users
Thousands of UK business professionals have had their personal details exposed online via a leaky Amazon Web Services bucket.
1000s of personal documents including passports.
A cloud misconfiguration at a now-defunct social media app has exposed hundreds of thousands of files, including explicit photos of users that they thought had been deleted.
32 Gb (377,000 files)
During December 2020
An unsecured Microsoft Azure Blob leaks deeply sensitive documents of more than 12,000 construction workers, including scans of passports, national IDs, birth certificates, and tax returns.
Sensitive documents of more than 12,000 construction workers
ShinyHunters sharee a database that he claims was stolen from Pixlr while he breached the 123rf stock photo site. Pixlr and 123rf are both owned by the same company, Inmagine.
1.9 million user records
The hacking group ShinyHunters leaks personal information of over 2 million MeetMindful users.
2.8 million user records
The largest real estate portal in Romania, Imobiliare, suffers a data breach after a bucket was found to be exposed, without password protection or encryption.
201,087 files belonging to 200,000 people
Confédération Européenne de Volleyball (CEV), or European Volleyball Confederation.
A publicly exposed cloud storage bucket was found to contain images of hundreds of passports and identity documents belonging to journalists and volleyball players from around the world.
Images of hundreds of passports and identity documents belonging to journalists and volleyball players from around the world.
A security lapse by a Jamaican government contractor exposes immigration records and COVID-19 test results for hundreds of thousands of travelers who visited the island over the past year.
70,000 negative COVID-19 lab results, over 425,000 immigration documents, and over 250,000 quarantine orders dating back to June 2020