Over 480 K Public Cloud Buckets Expose 18 Billion Files, Including Credentials and Backups
What Happened — The Ransomnews research team indexed 484,142 publicly listable cloud storage buckets in October 2026, uncovering 18.05 billion files. By analyzing bucket names, file extensions, counts and timestamps (without opening any files), they identified large concentrations of sensitive material: 321,058 files containing credentials or keys, numerous .env files, and many backups, payroll records and HR data. Amazon S3 accounts for 72 % of the buckets, while Azure Blob, though a smaller market share, is over‑represented in buckets labeled “backup”, “export”, “HR” or “payroll”. The researchers will repeat the scan quarterly to track trends.
Why It Matters for Trust & Control Assurance — Unchecked public bucket configurations breach the control objective of secure configuration management, a single control that underpins many frameworks.
Who Is Affected — Cloud‑dependent SaaS providers, enterprises storing backups or HR data in public cloud storage, and any organization that provisions cloud buckets without strict access policies.
Recommended Actions –
- Inventory all cloud storage assets and classify bucket purpose.
- Enforce least‑privilege bucket policies (block public read/list unless explicitly required).
- Deploy continuous monitoring that flags newly public buckets and records configuration changes as audit evidence.
- Validate that credential files are never stored in publicly accessible locations.
Technical Notes – The exposure stems from misconfigured bucket permissions (public read/list). No specific CVE is involved; the risk is operational rather than software‑based. The data includes credential files, database dumps, backups and HR‑related documents. Source: https://securityaffairs.com/202055/security/484142-exposed-cloud-buckets-contain-18-billion-files.html