Loading story…
Fiverr is facing scrutiny over reports that thousands of sensitive user files were publicly accessible online through Cloudinary-hosted URLs that could be indexed by search engines. Reported exposed material included tax forms, driver's licenses, work contracts, passwords, API keys, tax records, and private work deliverables. A security researcher said Fiverr was notified about the issue roughly 40 days before public disclosure, while reports alleged the files were stored with public links instead of restricted or expiring access controls.
Fiverr denied that the incident constituted a data breach and rejected allegations that it exposed user data, arguing that users had consented to share documents for marketplace transactions. Security experts challenged that position, saying consent to exchange files with counterparties does not equate to consent for unrestricted public internet exposure. The incident remains disputed, but the reports have raised concerns over third-party cloud storage practices, search engine indexing of sensitive documents, and potential risks of identity theft and credential compromise for affected users.
Map this exposure pattern across your cloud, code, and identities.
3 events from the most recent confirmed update back to the earliest known activity.
Fiverr rejected claims that it had suffered a data leak or security breach, arguing that users had consented to share files for marketplace purposes. Outside experts disputed that interpretation, saying transaction-related sharing does not imply unrestricted public exposure.
Reports stated that thousands of Fiverr-related files, including IDs, tax forms, contracts, passwords, API keys, and private work deliverables, were publicly accessible online due to storage practices involving a third-party cloud service. The exposure was described as an allegation rather than a confirmed breach.
A security researcher said Fiverr was notified about publicly accessible sensitive files roughly 40 days before the issue was publicly disclosed, but did not receive a response. The files were allegedly exposed through publicly reachable Cloudinary URLs that could be indexed by search engines.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybersecurity researcher Jeremiah Fowler discovered a publicly accessible database containing 178,519 files linked to the cloud-based invoicing platform Invoicely. The exposed database included a wide array of sensitive documents, such as invoices, scanned checks, tax forms, banking information in both PDF and CSV formats, and other financial records. Personally identifiable information (PII) was also present, including names, tax identification numbers, phone numbers, and physical addresses of clients, partners, and employees from around the world. Additional sensitive documents found in the database included medical payment receipts and airline tickets, further increasing the risk of identity theft and privacy violations. The database was not protected by a password or encryption, making it easily accessible to anyone who discovered its location online. The exposure of such data presents significant risks for financial fraud, particularly invoice fraud, as cybercriminals could use the information to create convincing fake invoices or target individuals and businesses for spear-phishing attacks. The presence of detailed financial and personal data could also facilitate broader identity theft schemes. Invoicely, operated by Vienna-based Stack Holdings GmbH, is a widely used platform, reportedly serving over 250,000 businesses globally, amplifying the potential impact of the breach. It remains unclear whether the exposed database was directly managed by Invoicely or by a third-party contractor, and there is no public information on how long the data was accessible or whether it was accessed by malicious actors. After Fowler reported the issue, the database was promptly taken offline to prevent further exposure. The incident highlights the critical importance of encrypting sensitive data and implementing robust access controls, as even a single misconfiguration can lead to massive data leaks. Fowler emphasized that proper encryption would have made the data extremely difficult to access without the correct credentials, even if the database was exposed. The event serves as a stark reminder for SaaS providers and their clients to regularly audit their data storage practices and ensure compliance with data protection standards. The lack of immediate clarity regarding the management and duration of the exposure raises concerns about potential regulatory and reputational consequences for Invoicely. Organizations using cloud-based financial platforms are urged to review their own security postures in light of this incident.
Jun 29, 2026
Flickr notified users of a **potential data breach** after discovering a vulnerability in a **third-party email service provider** system that may have enabled unauthorized access to some member information. Flickr said it was alerted to the flaw on **February 5, 2026** and disabled access to the affected system within hours. The company did not name the provider or disclose how many users were impacted, but stated that exposed data may include **real names/usernames, email addresses, account types, IP addresses, general location data, and account activity**. Flickr stated that **passwords and payment card data were not compromised**, reducing immediate risk of direct account takeover but increasing risk of **phishing and targeted social engineering** using the exposed profile and activity details. Users were advised to review account settings for unexpected changes and to be cautious of messages referencing their Flickr accounts, with Flickr emphasizing it will not request passwords via email. Separately, Substack reported a different breach involving unauthorized access to limited user data and dark web leak claims; it is not connected to the Flickr incident.
Jun 29, 2026
People-search service **ClarityCheck** left a cloud database publicly accessible without authentication, exposing more than **9 million image files** totaling roughly **450 GB**, including photographs of people’s faces used by its reverse image lookup service. Reporting said the images could be reached through URLs embedded in the site’s code, undermining the company’s claims that the service was private and secure because the data was only available through an unindexed link. The exposed repository remained accessible until media outreach prompted action, despite earlier notification from researcher **Jeremiah Fowler**. A separate misconfiguration also exposed users’ **email addresses** and **phone numbers**, expanding the incident from a privacy lapse to a broader personal-data exposure. Because ClarityCheck markets tools that can connect images to names and social profiles, the leak raised risks including **targeted phishing, impersonation, doxxing, and catfishing**, with the exposed face images described as sensitive biometric-adjacent data that could be abused if linked to contact information or online identities.
Aug 22, 2026