Publicly listable cloud storage buckets are exposing 18 billion files, including sensitive credentials, database dumps, and backups, according to the Ransomnews Cloud Exposure Index, as first reported by Security Affairs.
Researchers identified 484,142 open cloud storage buckets containing 18.05 billion files. The study, which analyzed bucket names and metadata without accessing file contents, revealed that Amazon S3 hosts 72% of these buckets. However, Azure Blob storage appears disproportionately often for sensitive categories like backups and payroll records. The findings highlight significant risks, including 321,058 files containing credentials and keys, such as .env files and private certificates.
These exposures present a major security threat, as attackers can exploit these files to gain unauthorized access to enterprise systems without needing to infect devices. The report emphasizes that while some buckets are intentionally public, many contain critical operational data that should remain private. Experts recommend that organizations enable cloud provider controls like S3 Block Public Access and perform regular scans for sensitive file types. The researchers warn that simply closing a bucket is insufficient if secrets have already been exposed, advising companies to rotate all credentials that were potentially accessible, as first reported by Security Affairs.
Source: Security Affairs
