Ransomnews index finds 484,142 publicly listable cloud buckets exposing 18 billion files, including .env secrets and backups
The Ransomnews research team, in an index authored by Mantas Sasnauskas, counted 484,142 publicly listable cloud storage buckets in October 2026 holding 18.05 billion files. The methodology relied only on bucket names, file extensions, file counts and last-modified timestamps from search engines that index open cloud storage — no files were opened. Amazon S3 accounts for 72% of exposed buckets (roughly its market share), while Azure Blob, at 14.2% of open buckets, is overrepresented 2.5–3.6x among buckets named for backups (37%), exports (42%) and HR/payroll (51%). Researchers counted 321,058 credential and key-related files, ~4.7 million database/dump files, 15,130 mailbox archives and thousands of virtual disk images (VMware, Hyper-V, QEMU). Of 80,495 .env files, 67% were modified in 2026, indicating live secrets that initial access brokers and ransomware affiliates can harvest without malware.
Detalhes técnicos
Sensitive extensions tracked include .env, .sql, .bak, .pem, .ppk, .tfstate and .kdbx. Terraform state files often carry plaintext secrets; KeePass vaults are open to offline cracking; disk images can contain entire servers with credentials. 89% of the 752,055 .bak files predate 2025, while nearly all PuTTY key files date from 2024. Exposure is ongoing: at least 113.6 million files were added to publicly listable buckets in the seven days before 9 September, including 21,000+ SQL dumps, ~21,000 backups, 4,477 .pem and 1,298 .env files over the prior 30 days. Names tied to regulated sectors (finance, healthcare, education, government, legal, HR) appear on 10,891 unique open buckets; healthcare-related names cover 2,709 buckets with 47.9 million files. Caveats: sector attribution is name-based, counts are capped at one million per query, and file-level data lags by about a month. No bucket is named; owners in regulated sectors are being notified via responsible disclosure with national CERTs copied.
Remediação
Enable S3 Block Public Access, disable anonymous access on Azure Blob storage, and turn on public access prevention in Google Cloud, applying controls at account/organization level. Scan storage for sensitive extensions, treat Terraform state and virtual disk images as secrets (private, encrypted, monitored), and never expose backups publicly. Rotate every secret that has ever resided in a public bucket — assume anything listable was copied.
Linha do tempo
-
Ransomnews index finds 484,142 publicly listable cloud buckets exposing 18 billion files, including .env secrets and backups
ler a análise desta fonte ocultar
The Ransomnews research team, in an index authored by Mantas Sasnauskas, counted 484,142 publicly listable cloud storage buckets in October 2026 holding 18.05 billion files. The methodology relied only on bucket names, file extensions, file counts and last-modified timestamps from search engines that index open cloud storage — no files were opened. Amazon S3 accounts for 72% of exposed buckets (roughly its market share), while Azure Blob, at 14.2% of open buckets, is overrepresented 2.5–3.6x among buckets named for backups (37%), exports (42%) and HR/payroll (51%). Researchers counted 321,058 credential and key-related files, ~4.7 million database/dump files, 15,130 mailbox archives and thousands of virtual disk images (VMware, Hyper-V, QEMU). Of 80,495 .env files, 67% were modified in 2026, indicating live secrets that initial access brokers and ransomware affiliates can harvest without malware.
Technical Details
Sensitive extensions tracked include .env, .sql, .bak, .pem, .ppk, .tfstate and .kdbx. Terraform state files often carry plaintext secrets; KeePass vaults are open to offline cracking; disk images can contain entire servers with credentials. 89% of the 752,055 .bak files predate 2025, while nearly all PuTTY key files date from 2024. Exposure is ongoing: at least 113.6 million files were added to publicly listable buckets in the seven days before 9 September, including 21,000+ SQL dumps, ~21,000 backups, 4,477 .pem and 1,298 .env files over the prior 30 days. Names tied to regulated sectors (finance, healthcare, education, government, legal, HR) appear on 10,891 unique open buckets; healthcare-related names cover 2,709 buckets with 47.9 million files. Caveats: sector attribution is name-based, counts are capped at one million per query, and file-level data lags by about a month. No bucket is named; owners in regulated sectors are being notified via responsible disclosure with national CERTs copied.
Remediation
Enable S3 Block Public Access, disable anonymous access on Azure Blob storage, and turn on public access prevention in Google Cloud, applying controls at account/organization level. Scan storage for sensitive extensions, treat Terraform state and virtual disk images as secrets (private, encrypted, monitored), and never expose backups publicly. Rotate every secret that has ever resided in a public bucket — assume anything listable was copied.