Ethical Hacking News
A staggering 484,142 cloud storage buckets contain 18 billion sensitive files, including exposed credentials, database dumps, backups, and other sensitive data. The report highlights the need for organizations to secure their cloud storage and implement robust security measures to prevent public access to sensitive files. With 10,891 unique open buckets in regulated sectors, the stakes are high, and it's essential to take proactive measures to protect sensitive information.
There are 484,142 publicly accessible cloud storage buckets containing sensitive information. These buckets store 18 billion files, including exposed credentials, database dumps, backups, and other sensitive data. Amazon S3 accounts for 72% of the exposed buckets, while Azure Blob appears 2.5 to 3.6 times more often than expected. 321,058 files related to credentials and keys are exposed, with 67% of .env files last modified in 2026. 10,891 unique open buckets are found in regulated sectors, such as finance, healthcare, education, government, legal, and HR. The report recommends securing cloud storage buckets, enabling S3 Block Public Access, and disabling anonymous access to Azure Blob storage. Organizations should scan their storage for sensitive files and implement robust security controls to prevent similar incidents in the future.
In October 2026, a report was published by Ransomnews, a cybersecurity research team, revealing the shocking truth about the number of publicly accessible cloud storage buckets containing sensitive information. The team discovered that a staggering 484,142 cloud buckets, which can be considered as the digital equivalent of file cabinets, contain a massive 18 billion files, including exposed credentials, database dumps, backups, and other sensitive data.
The researchers used a combination of bucket names, file types, file counts, and last-modified timestamps to collect their data. They did not open any files, allowing them to identify where sensitive information might be stored without accessing the content. The report also highlights the fact that many of these buckets are public on purpose, holding website assets, CDN mirrors, open datasets, and podcast archives.
Amazon S3 accounts for 72% of the exposed buckets, which is roughly in line with its share of the market. However, Azure Blob appears 2.5 to 3.6 times more often than expected among buckets named for backups, data exports, and payroll records. This skewed distribution of cloud storage buckets raises concerns about the security of these providers.
The researchers found that 321,058 files related to credentials and keys are exposed, and 67% of the .env files were last modified in 2026. The report also highlights the fact that many of the exposed buckets contain thousands of virtual disk images, including VMware, Hyper-V, and QEMU files, which can contain entire servers, including credentials.
The most worrying numbers are those related to regulated sectors, such as finance, healthcare, education, government, legal, and HR, which appear on 10,891 unique open buckets. These buckets often contain personal, health, or financial records, which is a major concern for regulators.
The report emphasizes the importance of securing cloud storage buckets and highlights the need for organizations to take proactive measures to prevent public access to sensitive files. The researchers recommend that organizations enable S3 Block Public Access, disable anonymous access to Azure Blob storage, and enable public access prevention in Google Cloud.
Moreover, the report suggests that organizations should scan their storage for sensitive files such as .env, .sql, .bak, .pem, .ppk, .tfstate, and .kdbx. Terraform state files and virtual disk images should be treated as secrets, stored privately, encrypted, and monitored. Backups should never be publicly accessible, and recovery procedures must be tested.
The report concludes by stating that organizations need to fix the underlying security controls, not just individual buckets. The researchers also highlight the importance of responsible disclosure and urge responsible disclosure teams to identify exposures with a known owner in regulated sectors.
The Ransomnews Cloud Exposure Index is a quarterly report that aims to track changes over time and provide insights into the evolving landscape of cloud storage security. The report serves as a wake-up call for organizations and cloud providers to take their security measures seriously and implement robust security controls to prevent similar incidents in the future.
Related Information:
https://www.ethicalhackingnews.com/articles/Exposing-the-Invisible-484142-Cloud-Buckets-Contain-18-Billion-Sensitive-Files-ehn.shtml
https://securityaffairs.com/202055/security/484142-exposed-cloud-buckets-contain-18-billion-files.html
Published: Thu Oct 29 14:59:01 2026 by llama3.2 3B Q4_K_M
