Loading story…
UpGuard identified 16,326 Supabase-hosted databases with publicly accessible tables, revealing a broad customer-side cloud-configuration failure. About half reportedly exposed personally identifiable information; exposed records also included private conversations, U.S. license-plate data, immigration and relocation-service contacts, passwords, authentication tokens, and in rare cases payment-card information. One database was allegedly associated with a virtual SIM farm linked to an African government consulate in France.
The researchers attributed the exposures to misconfigured access controls rather than a vulnerability in Supabase itself, warning that rapid deployment aided by AI coding tools can compound configuration risk. Supabase said projects are secure by default but that database permissions remain a shared responsibility, underscoring the need for customers to audit public tables, enforce least-privilege access controls, and rotate any credentials or tokens exposed through affected databases.
Map this exposure pattern across your cloud, code, and identities.
2 events from the most recent confirmed update back to the earliest known activity.
Supabase said projects are secure by default and that database security configuration is shared with customers. Its information-security leadership said customers control project configurations while Supabase provides secure defaults, tools, and threat notifications.
UpGuard identified 16,326 Supabase-hosted databases with publicly accessible tables, finding that roughly half exposed personally identifiable information and some exposed passwords, authentication tokens, or payment-card data. The firm attributed the issue to customer-side database access-control misconfigurations rather than an inherent Supabase platform breach.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcemalware.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybernews researchers reported multiple **data exposures caused by misconfigured back-end services**, including consumer mobile apps and a large unprotected database. Three widely downloaded Android AI photo identification apps—*Insect Identifier by Photo Cam*, *Dog Breed Identifier Photo Cam*, and *Spider Identifier App by Photo*—reportedly leaked more than **150,000** users’ data via a **Firebase misconfiguration** with inadequate authentication/access controls. Exposed data included email addresses, usernames, profile photos, notification tokens, and **GPS coordinates**; while passwords were not found, researchers noted the location data could enable stalking, doxxing, and targeted scams, and observed indications that automated bots had already discovered the exposed databases prior to the investigation. The apps were attributed to publisher **MobilMinds** (linked to **OZI Technologies**), and the developers reportedly did not respond to requests for comment. Separately, Cybernews identified an **unprotected Elasticsearch cluster** exposing approximately **8.7 billion records** associated with China, including names, birthdates, home addresses, national ID numbers, social media identifiers, usernames, and other account/platform details; the dataset also reportedly contained **plaintext credentials** and corporate/business records, suggesting long-term aggregation. The database’s ownership was not confirmed, but it was subsequently secured; researchers characterized the exposure as a systemic privacy risk potentially affecting hundreds of millions of individuals. Two additional items in the set describe individual bug-hunting writeups (e.g., bypassing mobile controls and abusing password reset/IDOR-style issues) but do not provide verifiable linkage to the specific Firebase/Elasticsearch exposures described above.
Jun 29, 2026
Security researchers reported a **critical Moltbook** exposure caused by an unauthenticated database/API access issue that allowed enumeration of agent records (e.g., `GET /api/agents/{id}`) and leakage of **email addresses, JWT `login_token`s, and third-party `api_key`s**, enabling agent hijacking and downstream abuse of connected services. Separately, **Cal.com Cloud** was found vulnerable to a chained set of broken access controls and signup/invite-token logic flaws that enabled **complete account takeover** and access to sensitive booking data (attendee details, emails, and booking histories) at scale, including organizational accounts. In parallel, SentinelLabs documented that roughly **175,000 internet-exposed Ollama** instances were reachable due to common deployment misconfiguration (binding to `0.0.0.0`/public interfaces), creating conditions for **arbitrary code execution** and access to external resources—especially where tool-calling features were enabled. A distinct IoT case study described **Molekule** air purifiers exposing fleet-wide telemetry because an **AWS Cognito Identity Pool** permitted unauthenticated access to **AWS IoT Core MQTT** subscriptions, leaking device shadow data (e.g., Wi‑Fi SSIDs, MAC addresses, device names, sensor readings) for ~100,000 devices; the disclosed policy reportedly allowed read/subscribe access but not device control without per-device certificates.
Jun 29, 2026
A misconfigured Elasticsearch server, believed to be operated from Russia or a Russian-speaking country, was discovered leaking over 6.19 billion records to the public internet without any authentication or password protection. The exposed server contained a massive trove of 1.12 terabytes of data, including records collected from both disclosed and undisclosed data breaches, as well as information obtained through website scraping. Among the most sensitive data found were records from Ukrainian bank Accordbank, which included users’ full names, birthdates, birthplaces, addresses, phone numbers, national ID numbers, passport numbers, and tax codes. Independent cybersecurity researcher Anurag Sen was the first to identify the exposed server and report its existence to the media. The server’s index information confirmed the scale of the exposure, with over 6.19 billion records available for anyone to access. Screenshots from the server revealed that the data was stored in JSON format and included detailed personally identifiable information (PII) from various sources. The database also contained files referencing Accordbank, which were later observed being peddled by the user "tRex_Prime" on DarkForums, indicating that the data may have already been accessed and distributed by other threat actors. The leak included not only banking and contact information but also records from other breaches and data scraped from websites, making the exposure particularly broad and damaging. The server was eventually taken offline, but it remains unclear how long the data was accessible or how many unauthorized parties may have downloaded the information. Previous incidents involving hacking groups such as ShinyHunters and Nemesis were also mentioned, as they had leaked stolen data and hacking tools from other exposed cloud storage resources in the past. The incident highlights the ongoing risks associated with misconfigured cloud infrastructure and the potential for large-scale data aggregation to amplify the impact of breaches. Security experts warn that such exposed databases are prime targets for cybercriminals seeking to exploit PII for identity theft, fraud, and further attacks. The presence of both old and new breach data, as well as scraped information, demonstrates the evolving tactics of threat actors in collecting and monetizing sensitive information. Organizations are urged to regularly audit their cloud configurations and monitor for unauthorized data exposures to prevent similar incidents. The scale and sensitivity of the leaked data underscore the urgent need for improved security practices in managing large datasets, especially those containing PII from multiple sources. The incident serves as a stark reminder of the consequences of failing to secure cloud-based data storage and the far-reaching impact such exposures can have on individuals and organizations worldwide.
Jul 12, 2026