Exposed Elasticsearch Sales Leads Database on AWS Leaks 5.8 M Personal Records
What Happened — In October 2018 security researcher Bob Diachenko discovered an unauthenticated Elasticsearch cluster hosted on AWS that exposed a sales‑lead dataset containing 5,788,169 unique records. The index held names, personal email addresses, employer names and physical addresses. No owner could be identified, so the breach is catalogued as “Elasticsearch Sales Leads”.
Why It Matters for Trust & Control Assurance
- Unprotected cloud data stores illustrate the exact gap a continuous control‑assurance program is built to detect: missing access restrictions and inadequate configuration monitoring.
- Demonstrating that you have automated evidence of cloud‑asset inventory, authentication enforcement, and change‑control logs provides a defensible audit trail for regulators and partners.
- Mapping this incident to the control objective of secure configuration management satisfies multiple frameworks simultaneously, reinforcing trust with customers.
Who Is Affected – Companies that store or purchase bulk sales‑lead data (marketing SaaS platforms, B2B lead‑generation services, and any organization that leverages cloud‑hosted Elasticsearch for customer data).
Recommended Actions –
- Conduct an immediate inventory of all Elasticsearch (or similar NoSQL) endpoints across your cloud environment.
- Enforce strong authentication and network‑level access controls (VPC, security groups, IAM policies).
- Deploy continuous configuration‑monitoring tools that capture and retain evidence of security‑group and access‑policy changes.
- Map the “secure configuration” control to your framework of record and collect the supporting logs for audit readiness.
Source: Have I Been Pwned – Elasticsearch Sales Leads breach
Technical Notes – The exposure resulted from a misconfigured Elasticsearch service that allowed anonymous HTTP GET requests. No known vulnerability (CVE) was exploited; the breach is purely a cloud‑misconfiguration issue. Data types leaked: email addresses, full names, employer names, and physical mailing addresses.