INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Cloud Buckets Contain 18 Billion Exposed Files

| 2026-10-29 18:43 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
On October 29, 2026, a large-scale data leak was discovered where 42 publicly listable cloud buckets contained approximately 18 billion files, including exposed credentials and database dumps. The Ransomnews research team counted these buckets using search engines that index open cloud storage, publishing the findings as the Ransomnews Cloud Exposure Index. This incident is attributed to Pierluigi Paganini of Security Affairs, who reported on it in a public .env file context. The affected products include Amazon S3 accounts for 72% of exposed buckets and Azure Blob, which appears more often than expected among buckets named for backups, data exports, and payroll records; specifically, 321,058 files related to credentials and keys were found.
Technical Mitigations AI-generated
• Patch Azure Blob accounts with "backup" or "export" in the name to reduce exposure of sensitive data. • Use a more secure naming convention for cloud buckets, such as avoiding names that indicate the presence of sensitive data (e.g. "dev", "test", "staging"). • Regularly review and update bucket permissions to ensure only authorized users have access to sensitive files. • Note: The text does not provide specific technical mitigations but rather highlights potential vulnerabilities in Azure Blob storage accounts with certain naming conventions.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope retailretail healthhealth financefinance
Incident Timeline
‎September 9
Threat actors added at least 113.6 million files to publicly listable buckets between September 2 and September 9, causing a lag in file-level figures by about a month.
data_breach 113.6 files
The problem is ongoing: at least 113.6 million files were added to publicly listable buckets in the seven days before September 9.
‎October 7
Threat actors exploited publicly accessible cloud buckets containing 18 billion files, with DigitalOcean Spaces and Alibaba OSS being among the providers.
organisation DigitalOcean Spaces
Below is the split by provider, from a snapshot taken on October 7: Provider Open buckets Share Amazon S3 347,984 71.9% Azure Blob 68,532 14.2% Google Cloud Storage 53,131 11.0% DigitalOcean Spaces 11,069 2.3% Alibaba OSS 3,426 0.7% Total 484,142 100% A lot of these buckets are public on purpose, holding website assets, CDN mirrors, open datasets and podcast archives.
organisation OSS
Below is the split by provider, from a snapshot taken on October 7: Provider Open buckets Share Amazon S3 347,984 71.9% Azure Blob 68,532 14.2% Google Cloud Storage 53,131 11.0% DigitalOcean Spaces 11,069 2.3% Alibaba OSS 3,426 0.7% Total 484,142 100% A lot of these buckets are public on purpose, holding website assets, CDN mirrors, open datasets and podcast archives.
organisation CDN
Below is the split by provider, from a snapshot taken on October 7: Provider Open buckets Share Amazon S3 347,984 71.9% Azure Blob 68,532 14.2% Google Cloud Storage 53,131 11.0% DigitalOcean Spaces 11,069 2.3% Alibaba OSS 3,426 0.7% Total 484,142 100% A lot of these buckets are public on purpose, holding website assets, CDN mirrors, open datasets and podcast archives.
general_metric 347,984 %
Below is the split by provider, from a snapshot taken on October 7: Provider Open buckets Share Amazon S3 347,984 71.9% Azure Blob 68,532 14.2% Google Cloud Storage 53,131 11.0% DigitalOcean Spaces 11,069 2.3% Alibaba OSS 3,426 0.7% Total 484,142 100% A lot of these buckets are public on purpose, holding website assets, CDN mirrors, open datasets and podcast archives.
general_metric 71.9 %
Below is the split by provider, from a snapshot taken on October 7: Provider Open buckets Share Amazon S3 347,984 71.9% Azure Blob 68,532 14.2% Google Cloud Storage 53,131 11.0% DigitalOcean Spaces 11,069 2.3% Alibaba OSS 3,426 0.7% Total 484,142 100% A lot of these buckets are public on purpose, holding website assets, CDN mirrors, open datasets and podcast archives.
general_metric 68,532 %
Below is the split by provider, from a snapshot taken on October 7: Provider Open buckets Share Amazon S3 347,984 71.9% Azure Blob 68,532 14.2% Google Cloud Storage 53,131 11.0% DigitalOcean Spaces 11,069 2.3% Alibaba OSS 3,426 0.7% Total 484,142 100% A lot of these buckets are public on purpose, holding website assets, CDN mirrors, open datasets and podcast archives.
general_metric 14.2 %
Below is the split by provider, from a snapshot taken on October 7: Provider Open buckets Share Amazon S3 347,984 71.9% Azure Blob 68,532 14.2% Google Cloud Storage 53,131 11.0% DigitalOcean Spaces 11,069 2.3% Alibaba OSS 3,426 0.7% Total 484,142 100% A lot of these buckets are public on purpose, holding website assets, CDN mirrors, open datasets and podcast archives.
general_metric 53,131 %
Below is the split by provider, from a snapshot taken on October 7: Provider Open buckets Share Amazon S3 347,984 71.9% Azure Blob 68,532 14.2% Google Cloud Storage 53,131 11.0% DigitalOcean Spaces 11,069 2.3% Alibaba OSS 3,426 0.7% Total 484,142 100% A lot of these buckets are public on purpose, holding website assets, CDN mirrors, open datasets and podcast archives.
general_metric 11.0 %
Below is the split by provider, from a snapshot taken on October 7: Provider Open buckets Share Amazon S3 347,984 71.9% Azure Blob 68,532 14.2% Google Cloud Storage 53,131 11.0% DigitalOcean Spaces 11,069 2.3% Alibaba OSS 3,426 0.7% Total 484,142 100% A lot of these buckets are public on purpose, holding website assets, CDN mirrors, open datasets and podcast archives.
general_metric 11,069 %
Below is the split by provider, from a snapshot taken on October 7: Provider Open buckets Share Amazon S3 347,984 71.9% Azure Blob 68,532 14.2% Google Cloud Storage 53,131 11.0% DigitalOcean Spaces 11,069 2.3% Alibaba OSS 3,426 0.7% Total 484,142 100% A lot of these buckets are public on purpose, holding website assets, CDN mirrors, open datasets and podcast archives.
general_metric 2.3 %
Below is the split by provider, from a snapshot taken on October 7: Provider Open buckets Share Amazon S3 347,984 71.9% Azure Blob 68,532 14.2% Google Cloud Storage 53,131 11.0% DigitalOcean Spaces 11,069 2.3% Alibaba OSS 3,426 0.7% Total 484,142 100% A lot of these buckets are public on purpose, holding website assets, CDN mirrors, open datasets and podcast archives.
general_metric 3,426 %
Below is the split by provider, from a snapshot taken on October 7: Provider Open buckets Share Amazon S3 347,984 71.9% Azure Blob 68,532 14.2% Google Cloud Storage 53,131 11.0% DigitalOcean Spaces 11,069 2.3% Alibaba OSS 3,426 0.7% Total 484,142 100% A lot of these buckets are public on purpose, holding website assets, CDN mirrors, open datasets and podcast archives.
general_metric 0.7 %
Below is the split by provider, from a snapshot taken on October 7: Provider Open buckets Share Amazon S3 347,984 71.9% Azure Blob 68,532 14.2% Google Cloud Storage 53,131 11.0% DigitalOcean Spaces 11,069 2.3% Alibaba OSS 3,426 0.7% Total 484,142 100% A lot of these buckets are public on purpose, holding website assets, CDN mirrors, open datasets and podcast archives.
general_metric 484,142 Total
Below is the split by provider, from a snapshot taken on October 7: Provider Open buckets Share Amazon S3 347,984 71.9% Azure Blob 68,532 14.2% Google Cloud Storage 53,131 11.0% DigitalOcean Spaces 11,069 2.3% Alibaba OSS 3,426 0.7% Total 484,142 100% A lot of these buckets are public on purpose, holding website assets, CDN mirrors, open datasets and podcast archives.
general_metric 100 %
Below is the split by provider, from a snapshot taken on October 7: Provider Open buckets Share Amazon S3 347,984 71.9% Azure Blob 68,532 14.2% Google Cloud Storage 53,131 11.0% DigitalOcean Spaces 11,069 2.3% Alibaba OSS 3,426 0.7% Total 484,142 100% A lot of these buckets are public on purpose, holding website assets, CDN mirrors, open datasets and podcast archives.
‎October 25
Threat actors queried search engines on October 25 to identify exposed cloud buckets containing files indexed up to September 9.
‎2026/10/29
Threat actors exploited 42 publicly listable cloud buckets containing sensitive data, including exposed credentials and database dumps.
data_breach 18 Files
484,142 Exposed Cloud Buckets Contain 18 Billion Files.
Exposed Cloud Buckets Contain 18 Billion Files 42 publicly listable cloud buckets containing 18 billion files, including exposed credentials, database dumps and backups.
data_breach 47.9 files
…e-commerce 5,666 269.9M Finance and insurance 3,508 58.0M Healthcare 2,709 47.9M Media and entertainment 2,696 136.2M Education 2,393 60.6M Gaming 2,296 79.0M Travel and hospitality 1,714 118.7M Real estate 1,137 60.7M Government and public sector 1,000 36.2M Legal 978 11.3M Crypto 630 11.9M HR and payroll 505 8.4M Healthcare-related names appear in 2,709 buckets containing 47.9 million files.
‎October 2026
Security researchers from Ransomnews identified 484,142 publicly listable cloud storage buckets containing over 18 billion files across various providers.
data_breach 18.05 files
The Ransomnews research team counted 484,142 publicly listable cloud storage buckets in October 2026, holding 18.05 billion files.
organisation SecurityAffairs
Follow me on Twitter:  @securityaffairs  and  Facebook  and  Mastodon Pierluigi Paganini ( SecurityAffairs  – hacking, Cloud Buckets) facebook linkedin twitter Cloud Cloud Buckets data leak Hacking hacking news information security news IT Information Security Pierluigi Paganini Security Affairs Security News
organisation IT Information Security
Follow me on Twitter:  @securityaffairs  and  Facebook  and  Mastodon Pierluigi Paganini ( SecurityAffairs  – hacking, Cloud Buckets) facebook linkedin twitter Cloud Cloud Buckets data leak Hacking hacking news information security news IT Information Security Pierluigi Paganini Security Affairs Security News
organisation Security Affairs
Follow me on Twitter:  @securityaffairs  and  Facebook  and  Mastodon Pierluigi Paganini ( SecurityAffairs  – hacking, Cloud Buckets) facebook linkedin twitter Cloud Cloud Buckets data leak Hacking hacking news information security news IT Information Security Pierluigi Paganini Security Affairs Security News
infrastructure Android
File type What it is Files listed .pem Certificates and private keys 113,285 .env App secrets and API keys 80,495 .p12 Certificate bundles with keys 33,268 .keystore Java and Android keystores 27,229 .ppk
organisation API
File type What it is Files listed .pem Certificates and private keys 113,285 .env App secrets and API keys 80,495 .p12 Certificate bundles with keys 33,268 .keystore Java and Android keystores 27,229 .ppk
infrastructure Windows
PuTTY SSH private keys 24,302 .pfx Windows certificate bundles 23,352 .ovpn OpenVPN client configs 15,079 .jks
The index caps any single count at one million, so larger types were split into date windows and summed.
organisation SSH
PuTTY SSH private keys 24,302 .pfx Windows certificate bundles 23,352 .ovpn OpenVPN client configs 15,079 .jks
victims 23,352 OpenVPN client
PuTTY SSH private keys 24,302 .pfx Windows certificate bundles 23,352 .ovpn OpenVPN client configs 15,079 .jks
victims 15,079 client configs
PuTTY SSH private keys 24,302 .pfx Windows certificate bundles 23,352 .ovpn OpenVPN client configs 15,079 .jks
organisation the Ransomnews Cloud Exposure Index
They built the count from the search engines that index open cloud storage and published it as the Ransomnews Cloud Exposure Index, written by Mantas Sasnauskas.
organisation Amazon S3
Amazon S3 accounts for 72% of the exposed buckets, roughly in line with its share of the market.
organisation S3
This does not mean S3 has weaker security than other providers.
data_breach 80,495 .env files
Of 80,495 .env files, 67% were last modified in 2026.
organisation Microsoft
The authors suspect Azure storage accounts more often hold line-of-business data such as backups, exports and HR systems that enterprises run on Microsoft, while S3 and Google Cloud carry more application assets.
organisation Terraform
A .tfstate file is Terraform’s record of a whole cloud setup, often with secrets in plain text, and a .kdbx vault is encrypted but now open to anyone who wants to guess passwords offline.
organisation Microsoft Access
.accdb Microsoft Access databases 36,467 .dmp Memory and crash dumps 12,809 .pst / .ost / .mbox Mailbox archives 15,130 .eml
data_breach 4.7 database
The exposed buckets also list about 4.7 million database and dump files, 15,130 mailbox archives, and tens of millions of spreadsheets and documents.
organisation VMware
Spreadsheets 42,544,997 .docx Word documents 24,936,788 .pdf Documents, invoices, scans at least 106,191,393 .log Application and server logs at least 61,310,809 The exposed buckets contain thousands of virtual disk images, including VMware, Hyper-V and QEMU files.
organisation QEMU
Spreadsheets 42,544,997 .docx Word documents 24,936,788 .pdf Documents, invoices, scans at least 106,191,393 .log Application and server logs at least 61,310,809 The exposed buckets contain thousands of virtual disk images, including VMware, Hyper-V and QEMU files.
organisation SQLite
Certificates and SQLite databases include both recent and older files.
data_breach 752,055 files
Backups appear older, with 89% of the 752,055 .bak files last modified before 2025.
organisation SQL
Over the previous 30 days, these included more than 21,000 SQL dumps, nearly 21,000 backup files, 4,477 .pem files and 1,298 .env files.
data_breach 21,000 backup files
Over the previous 30 days, these included more than 21,000 SQL dumps, nearly 21,000 backup files, 4,477 .pem files and 1,298 .env files.
data_breach 4,477 files
Over the previous 30 days, these included more than 21,000 SQL dumps, nearly 21,000 backup files, 4,477 .pem files and 1,298 .env files.
data_breach 1,298 .env files
Over the previous 30 days, these included more than 21,000 SQL dumps, nearly 21,000 backup files, 4,477 .pem files and 1,298 .env files.
organisation S3 Block Public Access
Organizations should enable S3 Block Public Access, disable anonymous access to Azure Blob storage, and enable public access prevention in Google Cloud.
organisation national CERTs copied
Exposures with a known owner in regulated sectors are going through responsible disclosure, with national CERTs copied where the owner is public sector or doesn’t respond.
organisation un
Closing the bucket does not un-leak the key.
data_breach 321,058 files
The researchers also found 321,058 files related to credentials and keys.
data_breach 2,421 password files
Java keystores 2,421 .htpasswd Web server password files 695 .tfstate Terraform infrastructure state 475 .kdbx KeePass password vaults 457 Each of these exists to grant access.
infrastructure 695 Terraform infrastructure state
Java keystores 2,421 .htpasswd Web server password files 695 .tfstate Terraform infrastructure state 475 .kdbx KeePass password vaults 457 Each of these exists to grant access.
infrastructure 475 Terraform infrastructure state
Java keystores 2,421 .htpasswd Web server password files 695 .tfstate Terraform infrastructure state 475 .kdbx KeePass password vaults 457 Each of these exists to grant access.
data_breach 457 password files
Java keystores 2,421 .htpasswd Web server password files 695 .tfstate Terraform infrastructure state 475 .kdbx KeePass password vaults 457 Each of these exists to grant access.
infrastructure 752,055 server backups
Database and server backups 752,055 .sql
data_breach 488,176 Database
Embedded app databases 488,176 .dump Database dumps 176,603 .mdb /
Tactical Metrics
Metrics
infrastructure
‎Android
Affected Product
File type What it is Files listed .pem Certificates and private keys 113,285 .env App secrets and API keys 80,495 .p12 Certificate bundles with keys 33,268 .keystore Java and Android keystores 27,229 .ppk
Metrics
infrastructure
‎Windows
Affected Product
PuTTY SSH private keys 24,302 .pfx Windows certificate bundles 23,352 .ovpn OpenVPN client configs 15,079 .jks
The index caps any single count at one million, so larger types were split into date windows and summed.
Metrics
victims
23,352
Openvpn Client
PuTTY SSH private keys 24,302 .pfx Windows certificate bundles 23,352 .ovpn OpenVPN client configs 15,079 .jks
Metrics
victims
15,079
Client Configs
PuTTY SSH private keys 24,302 .pfx Windows certificate bundles 23,352 .ovpn OpenVPN client configs 15,079 .jks
Metrics
data_breach
18,050,000,000
Files
The Ransomnews research team counted 484,142 publicly listable cloud storage buckets in October 2026, holding 18.05 billion files.
Metrics
data_breach
80,495
.Env Files
Of 80,495 .env files, 67% were last modified in 2026.
Metrics
data_breach
752,055
Files
Backups appear older, with 89% of the 752,055 .bak files last modified before 2025.
Metrics
data_breach
113,600,000
Files
The problem is ongoing: at least 113.6 million files were added to publicly listable buckets in the seven days before September 9.
Metrics
data_breach
21,000
Backup Files
Over the previous 30 days, these included more than 21,000 SQL dumps, nearly 21,000 backup files, 4,477 .pem files and 1,298 .env files.
Metrics
data_breach
4,477
Files
Over the previous 30 days, these included more than 21,000 SQL dumps, nearly 21,000 backup files, 4,477 .pem files and 1,298 .env files.
Metrics
data_breach
1,298
.Env Files
Over the previous 30 days, these included more than 21,000 SQL dumps, nearly 21,000 backup files, 4,477 .pem files and 1,298 .env files.
Metrics
data_breach
18,000,000,000
Files
484,142 Exposed Cloud Buckets Contain 18 Billion Files.
Exposed Cloud Buckets Contain 18 Billion Files 42 publicly listable cloud buckets containing 18 billion files, including exposed credentials, database dumps and backups.
Metrics
data_breach
321,058
Files
The researchers also found 321,058 files related to credentials and keys.
Metrics
data_breach
47,900,000
Files
…e-commerce 5,666 269.9M Finance and insurance 3,508 58.0M Healthcare 2,709 47.9M Media and entertainment 2,696 136.2M Education 2,393 60.6M Gaming 2,296 79.0M Travel and hospitality 1,714 118.7M Real estate 1,137 60.7M Government and public sector 1,000 36.2M Legal 978 11.3M Crypto 630 11.9M HR and payroll 505 8.4M Healthcare-related names appear in 2,709 buckets containing 47.9 million files.
Metrics
data_breach
4,700,000
Database
The exposed buckets also list about 4.7 million database and dump files, 15,130 mailbox archives, and tens of millions of spreadsheets and documents.
Metrics
data_breach
2,421
Password Files
Java keystores 2,421 .htpasswd Web server password files 695 .tfstate Terraform infrastructure state 475 .kdbx KeePass password vaults 457 Each of these exists to grant access.
Metrics
infrastructure
695
Terraform Infrastructure State
Java keystores 2,421 .htpasswd Web server password files 695 .tfstate Terraform infrastructure state 475 .kdbx KeePass password vaults 457 Each of these exists to grant access.
Metrics
infrastructure
475
Terraform Infrastructure State
Java keystores 2,421 .htpasswd Web server password files 695 .tfstate Terraform infrastructure state 475 .kdbx KeePass password vaults 457 Each of these exists to grant access.
Metrics
data_breach
457
Password Files
Java keystores 2,421 .htpasswd Web server password files 695 .tfstate Terraform infrastructure state 475 .kdbx KeePass password vaults 457 Each of these exists to grant access.
Metrics
infrastructure
752,055
Server Backups
Database and server backups 752,055 .sql
Metrics
data_breach
488,176
Database
Embedded app databases 488,176 .dump Database dumps 176,603 .mdb /
Intelligence Sources
Security Affairs 2026-10-29