Misconfigured cloud storage leaves 1.5B files exposed

Researchers found that the scourge of misconfigured cloud storage expands beyond the issues seen on Amazon Web Services and includes multiple network storage options.

A new report from Digital Shadows' Rafael Amado, strategy and research analyst, Michael Marriott, research analyst, and Rick Holland, CISO and vice president of strategy, detailed the researchers finding 1.5 billion files -- 12 petabytes of data -- exposed to the public on various misconfigured cloud storage solutions.

The researchers noted that while data exposures on AWS accounts have made headlines over the recent months -- with leaks from the Department of Defense, NSA and more -- Amazon S3 bucket exposures only made up 7% of what the Digital Shadows researchers found during scans over the first three months of 2018. Other misconfigured cloud storage options were more prevalent, including SMB (33%), rsync (28%) and FTP servers (26%), with misconfigured websites and network attached storage (NAS) drives making up the remaining 6%.

The exposed files were found around the globe, but the U.S. was the single most affected country with nearly 240 million files found. However, the researchers issued a warning to those in Europe because close to 540 million files were geolocated there, which will be a major issue once the General Data Protection Regulation (GDPR) begins enforcement in May.

"With GDPR fast-approaching, there are clear regulatory concerns for organizations surrounding the protection of personal data," the researchers wrote in "Too Much Information." "Loss of intellectual property also has considerable financial and reputational impacts."

Beyond the sheer amount of data exposed on the misconfigured cloud storage, Digital Shadows said there was a large amount of personal data to be found, such as payroll and tax return files; contact and patient lists; and point-of-sale data, including credit card information, personal health information, corporate intellectual property (IP) and even security audit reports.

"The exposure of personal information, IP, and security assessments can have significant impacts on the affected organization. This includes financial damage, privacy violation, and compliance issues," the researchers wrote. "For organizations that have failed to make these resources private, there are also reputational concerns -- although our research did reveal that former employees, contractors, and third parties were a leading cause of sensitive data exposure."