Billions of Files Exposed Due to Widespread Cloud Storage Misconfigurations

A comprehensive study conducted by Mysterium VPN researchers has revealed a severe vulnerability in cloud storage practices, leading to the public exposure of approximately 20 billion files. This alarming discovery, detailed in a report by Security Affairs, indicates that hundreds of thousands of cloud storage buckets across leading providers such as Amazon Web Services (S3), Google Cloud, Microsoft Azure, DigitalOcean, and Alibaba Cloud were found to be publicly accessible due to misconfigurations. Crucially, these files could be accessed directly via a URL using a standard web browser, requiring no advanced hacking techniques or malware. The investigation, which examined over 535,000 publicly listable cloud storage buckets in March 2026, focused on analyzing metadata, filenames, and file types rather than downloading content. This approach alone was sufficient to expose catastrophic security failures. Among the exposed data were highly sensitive items, including over 685,000 credential and key files (such as `.env` files and private cryptographic keys) and nearly 1 million database dumps (like `.sql` and `.bak` files). Such exposure grants potential attackers direct access to live systems, posing a far greater risk than mere data theft. The report underscores that the primary cause of this massive data exposure is not inherent insecurity in the cloud platforms themselves, but rather widespread misconfigurations by customers. While Amazon S3 buckets accounted for more than two-thirds of the exposed storage, the issue is systemic across various providers, pointing to a pervasive lack of operational discipline in managing cloud environments. The interconnectedness of these exposed files amplifies the risk, where a single misconfigured bucket can lead to a complete data breach. To mitigate these risks, the report strongly recommends several best practices. These include defaulting storage settings to private, strictly avoiding the storage of sensitive secrets in object storage, encrypting all backups, and implementing regular vulnerability scanning. For individual users, the advice extends to employing unique passwords, enabling multi-factor authentication, and exercising caution when sharing data with online services. The findings serve as a stark reminder that while cloud providers secure the platform, customers bear the ultimate responsibility for securing their configurations.