484,142 Exposed Cloud Buckets Contain 18 Billion Files
New research reveals massive cloud exposure risks across major storage providers and sectors.
1Massive Cloud Exposure Identified
The Ransomnews Cloud Exposure Index identified 484,142 publicly listable cloud storage buckets containing 18.05 billion files as of October 2026. Researchers utilized search engines to index these buckets without accessing file contents. This methodology ensures the study remains ethical while highlighting the significant scale of sensitive material concentration across global cloud infrastructure.
2Provider Distribution and Trends
Amazon S3 accounts for 71.9% of exposed buckets, reflecting its dominant market share. Azure Blob, however, shows a disproportionate frequency for operational data like backups and payroll records, appearing 2.5 to 3.6 times more often than expected. These findings suggest that specific cloud platforms may host different types of enterprise workloads.
3Sensitive Data in Public View
The index uncovered 321,058 files related to credentials and keys, including .env files and .pem certificates. Additionally, researchers found 4.7 million database dumps and millions of spreadsheets. These files often contain plain-text passwords or infrastructure state data, turning simple misconfigurations into critical security vulnerabilities for organizations across various global industries.
4Sector-Specific Risk Profiles
Regulated sectors including finance, healthcare, and government account for 10,891 unique open buckets. Healthcare-related terms like clinic and patient appear in over 2,700 buckets. Retail and e-commerce lead the volume with 5,666 buckets, primarily hosting storefront assets, though the presence of personal and financial records in other sectors remains a major concern.
5Operational Data and Azure Skew
Azure Blob storage hosts 37% of buckets labeled as backups and 51% of those containing HR or payroll terms. This skew is notably absent for development and staging environments, which align with baseline expectations. Researchers hypothesize that enterprises frequently utilize Azure for core line-of-business applications, increasing the impact of potential misconfigurations.
6Urgency of Recent Exposures
Analysis of file timestamps indicates ongoing risks, with 67% of exposed .env files modified in 2026. While some backups are older, the rapid addition of 113.6 million files to public buckets in a single week highlights a persistent failure in security management. Recent leaks require immediate remediation to prevent unauthorized access by malicious actors.
7Remediation and Best Practices
Organizations must enable native controls like S3 Block Public Access and disable anonymous access in Azure and Google Cloud. Security teams should scan for sensitive file types including .sql, .tfstate, and .kdbx. Furthermore, any secret previously stored in a public bucket must be rotated immediately, as exposure implies the data was likely copied.
8Methodology and Future Outlook
The research team plans to rerun the index quarterly to track security trends over time. Current limitations include a one-month lag in file-level data and the inability to prove ownership of specific buckets. Despite these constraints, the index provides a vital baseline for understanding how process failures lead to widespread cloud data exposure.
Original article: Security Affairs — 484,142 Exposed Cloud Buckets Contain 18 Billion Files