Indian Railways Exposes 583,000 User Accounts via Unprotected Firebase Database
What Happened — In November 2019 the Indian Railways public‑facing website left a Firebase database publicly accessible. The mis‑configured instance contained more than 2 million records, including 583 k unique email addresses, usernames and passwords stored in plain text.
Why It Matters for Trust & Control Assurance
- Unprotected cloud storage is a classic control‑gap that a continuous control‑assurance program is built to detect and remediate.
- Demonstrable evidence of proper configuration and ongoing monitoring satisfies the same control objective across many frameworks (e.g., NIST CSF 2.0).
- The breach shows the audit‑readiness risk of storing credentials in clear text; robust access‑control and data‑protection controls must be continuously verified.
Who Is Affected – Transportation & logistics (Indian Railways) and any public‑sector organization using similar cloud services.
Recommended Actions
- Conduct an immediate inventory of all cloud storage assets and verify that public read access is disabled.
- Implement continuous monitoring of cloud configurations and retain immutable evidence for audit purposes.
- Replace plaintext password storage with salted hashing and enforce strong credential policies. Source: Have I Been Pwned – Indian Railways breach
Technical Notes – Attack vector: cloud misconfiguration (unprotected Firebase DB). Exposed data types: email addresses, usernames, plaintext passwords. No known CVE; the issue stems from improper configuration rather than a software vulnerability. Source: HIBP API