Ransomnews tally finds 484,142 open cloud buckets holding 18.05B files

Key points

• Ransomnews researchers counted 484,142 buckets and 18.05B files exposed via public cloud storage.
• Exposures include credentials, database dumps, backups and ordinary files.
• The tally was built from search-engine indexes, not confirmed victim notifications.
• K-12 and government teams should treat public buckets as a recurring misconfiguration risk.

In October 2026, Ransomnews researchers published an aggregate measurement of publicly reachable cloud storage. They queried search-engine indexes to identify buckets and counted 484,142 buckets containing 18.05 billion files. The result is a broad exposure tally, not a confirmed list of breached organizations.

The exposed content spans several high-risk categories: authentication secrets, database exports, backup archives, and ordinary files. Even a single exposed credential or backup can give an intruder a path into production systems or a way to bypass controls. For school districts and government agencies, such data can include identity records, operational documents, and system configuration.

The scale matters less than the pattern. Public buckets are often created for convenience, forgotten during migrations, or left open by misconfigured permissions. Search engines can index them when directory listing or object permissions allow it. The researchers' method shows how quickly an automated scan can turn scattered misconfigurations into a sector-wide visibility problem.

The tally does not prove that every bucket belongs to a school or agency, and it does not confirm that all files are sensitive. It does, however, give defenders a reminder to verify what is actually public. Exposure of credentials and backups is especially dangerous because it can lead to account takeover, data loss, or ransomware staging.

Watch for follow-up reporting that names sectors or providers, and for attackers using the published tally as a target list. IT teams should prioritize discovery, removal of public access, secret rotation, and monitoring. Treat any public bucket as a potential incident until proven otherwise.

What to do now

1. Inventory all cloud storage buckets across accounts and projects; tag owners and data classification.
2. Immediately block public access at the account or project level and remove public ACLs and policies from buckets containing credentials, backups, or database exports.
3. Rotate any credentials, API keys, tokens, and connection strings found in or near exposed storage; revoke unused keys.
4. Search for and request removal of indexed bucket URLs; disable directory listing and static website hosting where not needed.
5. Enable storage access logging, anomaly detection, and alerts for public bucket creation or policy changes.
6. Review backup and database export locations; encrypt at rest and restrict access to approved roles.
7. Run a tabletop exercise for exposed-bucket incidents and document notification and escalation paths.

Original source

Security Affairs