Loading story…
Nextcloud left an internal Elasticsearch database publicly accessible, exposing about 367,000 records and roughly 7.92 GB of data that included invoices, client contracts, employee information, internal documents, unencrypted email files, beta tester lists, file-sharing metadata, and deployment scripts. Some of the exposed shell and Python scripts reportedly contained hardcoded database credentials, increasing the risk of follow-on compromise, while referenced external domains included providers such as IONOS and STRATO as well as German government entities including MSB NRW.
The database was discovered on May 18 and secured on May 27, two days after notification, according to reporting cited by Cybernews and others. Nextcloud said the exposure resulted from a hosting infrastructure misconfiguration rather than a flaw in its product, stated that no customer-operated servers were affected, and said it had no evidence of unauthorized access or exploitation before the database was locked down; the company also reported the incident to the relevant state data protection officer.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Following the exposure, Nextcloud reported the matter to the relevant state data protection officer. The company also stated that no customer-operated servers were affected and that it had no evidence of unauthorized access before the database was closed.
Nextcloud reportedly secured the exposed Elasticsearch database on 2026-05-27, two days after being notified. The company said the exposure was caused by a hosting infrastructure misconfiguration rather than a flaw in Nextcloud software.
Cybernews reportedly found a publicly accessible Elasticsearch cluster belonging to Nextcloud on 2026-05-18. The database contained about 7.92 GB of data across roughly 367,000 records, including invoices, contracts, internal documents, emails, and scripts with hardcoded database credentials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecyberveille.ch
Open sourceteiss.co.uk
Open sourcecybernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A misconfigured Elasticsearch server, believed to be operated from Russia or a Russian-speaking country, was discovered leaking over 6.19 billion records to the public internet without any authentication or password protection. The exposed server contained a massive trove of 1.12 terabytes of data, including records collected from both disclosed and undisclosed data breaches, as well as information obtained through website scraping. Among the most sensitive data found were records from Ukrainian bank Accordbank, which included users’ full names, birthdates, birthplaces, addresses, phone numbers, national ID numbers, passport numbers, and tax codes. Independent cybersecurity researcher Anurag Sen was the first to identify the exposed server and report its existence to the media. The server’s index information confirmed the scale of the exposure, with over 6.19 billion records available for anyone to access. Screenshots from the server revealed that the data was stored in JSON format and included detailed personally identifiable information (PII) from various sources. The database also contained files referencing Accordbank, which were later observed being peddled by the user "tRex_Prime" on DarkForums, indicating that the data may have already been accessed and distributed by other threat actors. The leak included not only banking and contact information but also records from other breaches and data scraped from websites, making the exposure particularly broad and damaging. The server was eventually taken offline, but it remains unclear how long the data was accessible or how many unauthorized parties may have downloaded the information. Previous incidents involving hacking groups such as ShinyHunters and Nemesis were also mentioned, as they had leaked stolen data and hacking tools from other exposed cloud storage resources in the past. The incident highlights the ongoing risks associated with misconfigured cloud infrastructure and the potential for large-scale data aggregation to amplify the impact of breaches. Security experts warn that such exposed databases are prime targets for cybercriminals seeking to exploit PII for identity theft, fraud, and further attacks. The presence of both old and new breach data, as well as scraped information, demonstrates the evolving tactics of threat actors in collecting and monetizing sensitive information. Organizations are urged to regularly audit their cloud configurations and monitor for unauthorized data exposures to prevent similar incidents. The scale and sensitivity of the leaked data underscore the urgent need for improved security practices in managing large datasets, especially those containing PII from multiple sources. The incident serves as a stark reminder of the consequences of failing to secure cloud-based data storage and the far-reaching impact such exposures can have on individuals and organizations worldwide.
Jul 12, 2026
A massive data exposure incident occurred involving Netcore Cloud, an Indian-based global email marketing and automation company, when a misconfigured server left over 40 billion records and 13.4 terabytes of data publicly accessible. The exposed database contained unencrypted mail logs, which included sensitive information such as email addresses, message subjects, internal delivery details, and technical data like IP addresses and SMTP configurations. Among the leaked records were healthcare notifications, banking activity alerts, and employment-related emails, some of which were marked as confidential. The data was accessible to anyone who knew the server’s IP address, posing a significant risk of unauthorized access and potential misuse. The breach affected Netcore Cloud’s global client base, which spans more than 6,500 brands across 40 countries and includes organizations in sectors such as ecommerce, finance, media, and travel. The exposure was discovered by cybersecurity researcher Jeremiah Fowler, who reported the issue after finding the database unprotected and unencrypted. Upon notification, Netcore Cloud responded promptly by securing the database and restricting public access on the same day. The company also requested additional information from the researcher to support its internal investigation. The incident highlights the risks associated with misconfigured cloud infrastructure, especially for companies handling large volumes of sensitive communication data. The scale of the exposure, both in terms of record count and data volume, makes it one of the more significant data leaks in recent times. The presence of confidential and technical information in the logs could facilitate further attacks, such as phishing or account compromise, if accessed by malicious actors. The incident underscores the importance of robust security controls, regular audits, and prompt response protocols for organizations managing critical customer data. Netcore Cloud’s swift action in securing the database likely mitigated further risk, but the exposure period remains unclear. The breach has raised concerns about data privacy and the security practices of third-party service providers in the email marketing industry. Organizations using Netcore Cloud’s services may need to assess their own exposure and consider additional safeguards. The event serves as a cautionary tale for all companies relying on cloud-based infrastructure to ensure proper configuration and continuous monitoring to prevent similar incidents.
Jul 12, 2026
A 4TB+ SQL Server backup file belonging to Ernst & Young (EY) was discovered exposed to the public internet due to a cloud storage misconfiguration. The backup, which was unencrypted, contained highly sensitive information including API keys, session tokens, cached authentication tokens, service account passwords, and user credentials. The exposure was identified by Neo Security, whose lead researcher found and partially downloaded the file, confirming the presence of critical secrets. The incident highlights the risks associated with cloud storage misconfigurations, where even brief exposures can be detected and exploited by automated scans. Upon being notified by Neo Security, EY responded promptly and professionally, acknowledging the issue and engaging in clear, technical communication with the researchers. The firm’s incident response was described as "textbook perfect," with the vulnerability triaged and fully remediated within a week. The case underscores the importance of mature security practices and rapid response in mitigating the impact of accidental data exposures, especially when large volumes of sensitive corporate data are at risk.
Jun 29, 2026