https://upguard-staging.webflow.ioSubscribe to UpGuard's data breach research and get notified when new research is released.Thu, 18 Dec 2025 01:02:30 GMTWebflowhttps://upguard-staging.webflow.io/breaches/streamlit-the-tip-of-the-shadow-ai-iceberghttps://upguard-staging.webflow.io/breaches/streamlit-the-tip-of-the-shadow-ai-icebergTens of thousands of AI-enabled web applications using the Streamlit framework are publicly available, exposing PII and other confidential data. Tue, 09 Dec 2025 23:19:01 GMThttps://upguard-staging.webflow.io/breaches/identifying-companies-affected-by-the-shai-hulud-npm-supply-chain-attackhttps://upguard-staging.webflow.io/breaches/identifying-companies-affected-by-the-shai-hulud-npm-supply-chain-attackUsing Github event archives, UpGuard Research identifies companies with indicators of compromise of the Shai-Hulud attacks, even after the repos have been deleted. Fri, 24 Oct 2025 04:08:27 GMThttps://upguard-staging.webflow.io/breaches/india-bank-transfers-data-leakhttps://upguard-staging.webflow.io/breaches/india-bank-transfers-data-leakUpGuard discovered a rapidly growing data leak of bank accounts in India– and no one to take responsibility for it. Fri, 26 Sep 2025 16:05:20 GMThttps://upguard-staging.webflow.io/breaches/traffic-patterns-the-leakzone-part-2https://upguard-staging.webflow.io/breaches/traffic-patterns-the-leakzone-part-2UpGuard analyzes the universities, governments, and private companies mentioned in the access logs of hacker forum Leakzone. Tue, 12 Aug 2025 23:13:57 GMThttps://upguard-staging.webflow.io/breaches/workcycle-tpl-langflow-leak-pakistanhttps://upguard-staging.webflow.io/breaches/workcycle-tpl-langflow-leak-pakistanUpGuard can now report that we have secured a Langflow instance leaking data for around 97,000 insurance customers in Pakistan.Tue, 12 Aug 2025 16:00:01 GMThttps://upguard-staging.webflow.io/breaches/aggregate-iq-part-four-canadahttps://upguard-staging.webflow.io/breaches/aggregate-iq-part-four-canadaLearn more about how a data exposure from within Cambridge Analytica-linked firm AggregateIQ reveals web assets built for Canadian politicians and parties.Tue, 05 Aug 2025 01:32:13 GMThttps://upguard-staging.webflow.io/breaches/leakzone-nethttps://upguard-staging.webflow.io/breaches/leakzone-netUpGuard discovered an unauthenticated Elasticsearch database containing 22 million records of user traffic for hacking forum leakzone.net. Sat, 26 Jul 2025 03:27:49 GMThttps://upguard-staging.webflow.io/breaches/cloud-leak-inscomhttps://upguard-staging.webflow.io/breaches/cloud-leak-inscomA sensitive S3 bucket left wide open, containing highly classified 'NOFORN' data, was discovered by the UpGuard team.Sat, 26 Jul 2025 03:27:49 GMThttps://upguard-staging.webflow.io/breaches/tetrad-breach-120-million-householdshttps://upguard-staging.webflow.io/breaches/tetrad-breach-120-million-householdsA collection of data sets detailing the purchasing habits and consumer behavior profiles of 120 million American households was exposed by Tetrad. Sat, 26 Jul 2025 03:27:49 GMThttps://upguard-staging.webflow.io/breaches/data-leak-neoclinical-australia-new-zealandhttps://upguard-staging.webflow.io/breaches/data-leak-neoclinical-australia-new-zealandA company that matches individuals with clinical trials in Australia and New Zealand exposed personal information on over 37,000 people via a misconfigured MongoDB.Sat, 26 Jul 2025 03:27:49 GMThttps://upguard-staging.webflow.io/breaches/data-leak-dscc-six-million-email-addresseshttps://upguard-staging.webflow.io/breaches/data-leak-dscc-six-million-email-addressesAn AWS S3 bucket configured for public access contained a file from 2010 with six million email addresses, apparently from the Democratic Senatorial Campaign Committee. Sat, 26 Jul 2025 03:27:49 GMThttps://upguard-staging.webflow.io/breaches/aggregate-iq-part-onehttps://upguard-staging.webflow.io/breaches/aggregate-iq-part-onePolitical data firm AggregateIQ exposed IT assets that raise questions for society about how technology is being used in recent US political history.Sat, 26 Jul 2025 03:27:49 GMThttps://upguard-staging.webflow.io/breaches/cloud-leak-viacomhttps://upguard-staging.webflow.io/breaches/cloud-leak-viacomAn internet-exposed Puppet master and secret keys left the media empire's cloud assets vulnerable to exploitation.Sat, 26 Jul 2025 03:27:49 GMThttps://upguard-staging.webflow.io/breaches/data-leak-hipaa-medico-s3https://upguard-staging.webflow.io/breaches/data-leak-hipaa-medico-s3Thousands of files including medical, business, and legal data were exposed via a misconfigured AWS S3 storage bucket.Sat, 26 Jul 2025 03:27:49 GMThttps://upguard-staging.webflow.io/breaches/identity-and-access-misstep-how-an-amazon-engineer-exposed-credentials-and-morehttps://upguard-staging.webflow.io/breaches/identity-and-access-misstep-how-an-amazon-engineer-exposed-credentials-and-moreAn AWS engineer uploaded personal information and system credentials to GitHub. UpGuard notified AWS Security to secure the data. Sat, 26 Jul 2025 03:27:49 GMThttps://upguard-staging.webflow.io/breaches/aggregate-iq-part-two-brexithttps://upguard-staging.webflow.io/breaches/aggregate-iq-part-two-brexitLearn more about how the exposed files of data firm AggregateIQ cast light on the world of British politics.Sat, 26 Jul 2025 03:27:49 GMThttps://upguard-staging.webflow.io/breaches/open-enrollment-how-hcl-exposed-employee-passwords-and-project-datahttps://upguard-staging.webflow.io/breaches/open-enrollment-how-hcl-exposed-employee-passwords-and-project-dataThe UpGuard data breach research team discovered and secured leaks from IT services provider HCL, including new employee passwords.Sat, 26 Jul 2025 03:27:49 GMThttps://upguard-staging.webflow.io/breaches/la-county-211-hotlinehttps://upguard-staging.webflow.io/breaches/la-county-211-hotlineLearn how 3.5 million records were exposed by Los Angeles County 211, including names, addresses, and call notes detailing reports of abuse and crisis.Sat, 26 Jul 2025 03:27:49 GMThttps://upguard-staging.webflow.io/breaches/short-circuit-how-a-robotics-vendor-exposed-confidential-data-for-major-manufacturing-companieshttps://upguard-staging.webflow.io/breaches/short-circuit-how-a-robotics-vendor-exposed-confidential-data-for-major-manufacturing-companiesManufacturing companies rely on robotics automation to power their factories and ultimately, their businesses. See how one robotics vendor exposed confidential information for over 100 clients, including divisions of Toyota, Ford, GM, and Tesla.Sat, 26 Jul 2025 03:27:49 GMThttps://upguard-staging.webflow.io/breaches/credit-crunch-national-credit-federationhttps://upguard-staging.webflow.io/breaches/credit-crunch-national-credit-federation111 GB of internal customer information from National Credit Federation was left exposed in a publicly downloadable data repository. This is its story.Sat, 26 Jul 2025 03:27:49 GMThttps://upguard-staging.webflow.io/breaches/cloud-leak-chicago-votershttps://upguard-staging.webflow.io/breaches/cloud-leak-chicago-votersUpGuard has identified an exposure of Chicago voters' personal information by an electronic voting machine firm.Sat, 26 Jul 2025 03:27:49 GMThttps://upguard-staging.webflow.io/breaches/how-medical-records-and-patient-doctor-recordings-were-exposedhttps://upguard-staging.webflow.io/breaches/how-medical-records-and-patient-doctor-recordings-were-exposedThe intersection of information technology and healthcare creates new and improved functionality for managing and delivering healthcare services, but it also entails new risks. See how one telemedicine company exposed thousands of medical records and hundreds of patient-doctor recordings online.Sat, 26 Jul 2025 03:27:49 GMThttps://upguard-staging.webflow.io/breaches/aggregate-iq-part-three-monarchhttps://upguard-staging.webflow.io/breaches/aggregate-iq-part-three-monarchLearn for the first time about the secret tools developed by AggregateIQ for purposes of tracking and influencing internet users, including on Facebook.Sat, 26 Jul 2025 03:27:49 GMThttps://upguard-staging.webflow.io/breaches/amazon-s3-how-tea-party-campaign-assets-were-exposed-onlinehttps://upguard-staging.webflow.io/breaches/amazon-s3-how-tea-party-campaign-assets-were-exposed-onlineRead how a misconfigured Amazon S3 bucket exposed strategy documents and voter call lists for the Tea Party Citizen's Fund. Sat, 26 Jul 2025 03:27:49 GMThttps://upguard-staging.webflow.io/breaches/s3-localbloxhttps://upguard-staging.webflow.io/breaches/s3-localbloxLearn how over 48 million records containing personal data leaked from within the systems of a private intelligence search service.Sat, 26 Jul 2025 03:27:49 GMThttps://upguard-staging.webflow.io/breaches/public-relations-how-a-marketing-pr-platform-exposed-thousands-of-usershttps://upguard-staging.webflow.io/breaches/public-relations-how-a-marketing-pr-platform-exposed-thousands-of-usersA misconfigured Amazon S3 storage bucket leaked data from iPR Software, exposing tens of thousands of user accounts and client documents. Sat, 26 Jul 2025 03:27:49 GMThttps://upguard-staging.webflow.io/breaches/rsync-medicalhttps://upguard-staging.webflow.io/breaches/rsync-medicalData from a Huntingon, NY medical practice was left publicly exposed via a misconfigured rsync server, exposing information about staff and forty thousand patients.Sat, 26 Jul 2025 03:27:49 GMThttps://upguard-staging.webflow.io/breaches/hr-violation-how-a-corporate-data-exposure-can-affect-employeeshttps://upguard-staging.webflow.io/breaches/hr-violation-how-a-corporate-data-exposure-can-affect-employeesUpGuard discovered and helped secure an Australian company's code repository containing SQL backups of employee information, banking data, and more.Sat, 26 Jul 2025 03:27:49 GMThttps://upguard-staging.webflow.io/breaches/spartan-south-carolina-arrest-records-data-exposurehttps://upguard-staging.webflow.io/breaches/spartan-south-carolina-arrest-records-data-exposureEveryone who depends on tech assumes its risks. The justice system is no exception. See how detailed arrest records for South Carolina were exposed online.Sat, 26 Jul 2025 03:27:49 GMThttps://upguard-staging.webflow.io/breaches/out-of-pocket-how-an-isp-exposed-administrative-system-credentialshttps://upguard-staging.webflow.io/breaches/out-of-pocket-how-an-isp-exposed-administrative-system-credentialsISPs do more than provide internet service for individual customers-- they can also act as part of US critical infrastructure. See how one ISP exposed their administrative and root passwords to the public.Sat, 26 Jul 2025 03:27:49 GMThttps://upguard-staging.webflow.io/breaches/spy-games-booz-allen-hamilton-pentagonhttps://upguard-staging.webflow.io/breaches/spy-games-booz-allen-hamilton-pentagonWhile this blog post provides a description of a data exposure discovery involving Booz Allen Hamilton and the US National Geospatial-Intelligence Agency (NGA), this is no longer an active data breach.Sat, 26 Jul 2025 03:27:49 GMThttps://upguard-staging.webflow.io/breaches/public-domain-how-configuration-information-for-the-worlds-largest-domain-name-registrar-was-exposed-onlinehttps://upguard-staging.webflow.io/breaches/public-domain-how-configuration-information-for-the-worlds-largest-domain-name-registrar-was-exposed-onlineThe UpGuard Cyber Risk Team has discovered and secured a data exposure of documents appearing to describe GoDaddy infrastructure running in the Amazon AWS cloud, preventing any future exploitation of this information.Sat, 26 Jul 2025 03:27:49 GMThttps://upguard-staging.webflow.io/breaches/verizon-cloud-leakhttps://upguard-staging.webflow.io/breaches/verizon-cloud-leakAccount details for up to 14 million Verizon customers have been left totally exposed by a third-party vendor.Sat, 26 Jul 2025 03:27:49 GMThttps://upguard-staging.webflow.io/breaches/cloud-leak-tigerswanhttps://upguard-staging.webflow.io/breaches/cloud-leak-tigerswanThousands of resumes belonging to individuals applying to security firm TigerSwan were found publicly exposed in an AWS S3 bucket.Sat, 26 Jul 2025 03:27:49 GMThttps://upguard-staging.webflow.io/breaches/nas-leak-mdjiahttps://upguard-staging.webflow.io/breaches/nas-leak-mdjiaA shared-risk property insurance provider in Maryland left exposed data revealing the personal details of thousands of customers.Sat, 26 Jul 2025 03:27:49 GMThttps://upguard-staging.webflow.io/breaches/rsync-oklahoma-securities-commissionhttps://upguard-staging.webflow.io/breaches/rsync-oklahoma-securities-commissionA storage server configured for public access exposed millions of files belonging to the Oklahoma Securities Commission.Thu, 10 Jul 2025 08:09:36 GMThttps://upguard-staging.webflow.io/breaches/rsync-tdmhttps://upguard-staging.webflow.io/breaches/rsync-tdmLearn how the personal information of over one million individuals was exposed online, through a marketing network geared towards internet users interested in higher education.Thu, 10 Jul 2025 08:09:36 GMThttps://upguard-staging.webflow.io/breaches/mts-nokia-telecom-inventory-data-exposurehttps://upguard-staging.webflow.io/breaches/mts-nokia-telecom-inventory-data-exposureA storage device containing 1.7 terabytes of information detailing telecommunications installations throughout the Russian Federation was exposed to the public internet.Thu, 10 Jul 2025 08:09:36 GMThttps://upguard-staging.webflow.io/breaches/facebook-user-data-leakhttps://upguard-staging.webflow.io/breaches/facebook-user-data-leakThird-party Facebook apps gather Facebook data about the people who use them. While Facebook struggles to contain these exposures, insecure third-party data practices & misconfigured cloud systems continue to leak Facebook data to the internet. See how UpGuard discovered and secured two such cases.Thu, 10 Jul 2025 08:09:36 GMThttps://upguard-staging.webflow.io/breaches/the-rnc-fileshttps://upguard-staging.webflow.io/breaches/the-rnc-filesUpGuard has discovered an open database containing information on what appear to be approximately 198 million American voters left misconfigured by a GOP analytics firm.Thu, 10 Jul 2025 08:09:36 GMThttps://upguard-staging.webflow.io/breaches/cloud-leak-alteryxhttps://upguard-staging.webflow.io/breaches/cloud-leak-alteryxThis cloud leak reveals the personal details of 123 million US households, revealing in-depth analysis of their finances sold by credit reporting agency Experian.Thu, 10 Jul 2025 08:09:36 GMThttps://upguard-staging.webflow.io/breaches/cloud-leak-dow-joneshttps://upguard-staging.webflow.io/breaches/cloud-leak-dow-jonesSensitive data points on millions of Dow Jones publication customers were exposed in a massive cloud leak.Thu, 10 Jul 2025 08:09:36 GMThttps://upguard-staging.webflow.io/breaches/cloud-leak-accenturehttps://upguard-staging.webflow.io/breaches/cloud-leak-accentureMultiple sensitive buckets belonging to the corporation were found publicly exposed, revealing credentials, keys, and customer information.Thu, 10 Jul 2025 08:09:36 GMThttps://upguard-staging.webflow.io/breaches/attunity-data-leakhttps://upguard-staging.webflow.io/breaches/attunity-data-leakBackups ensure data continuity, but they're also a surface of risk. See how Fortune 100 vendor Attunity exposed nearly a terabyte of internal backups.Thu, 10 Jul 2025 08:09:36 GMThttps://upguard-staging.webflow.io/breaches/data-leak-pqehttps://upguard-staging.webflow.io/breaches/data-leak-pqeAn unprotected backup at a Texas engineering firm exposes critical infrastructure data and information on sensitive clients serving the state.Thu, 10 Jul 2025 08:09:36 GMThttps://upguard-staging.webflow.io/breaches/cloud-leak-centcomhttps://upguard-staging.webflow.io/breaches/cloud-leak-centcomAs soon as the UpGuard Cyber Risk Team notified the Defense Department of this publicly exposed information, immediate action was taken, securing the open buckets and preventing further access.Thu, 10 Jul 2025 08:09:36 GMThttps://upguard-staging.webflow.io/breaches/chroma-my-jedai-canvahttps://upguard-staging.webflow.io/breaches/chroma-my-jedai-canvaUpGuard can now report that it has secured a Chroma database containing 341 collections of data for AI applications, including a survey of Canva Creators.Mon, 23 Jun 2025 04:51:01 GMThttps://upguard-staging.webflow.io/breaches/data-leak-apisechttps://upguard-staging.webflow.io/breaches/data-leak-apisecUpGuard can now report that it has secured an Elasticsearch database containing data from APIsec.ai, a security company that claims to be used by 80% of the Fortune 100.Mon, 23 Jun 2025 04:51:01 GMThttps://upguard-staging.webflow.io/breaches/angelsense-data-leakhttps://upguard-staging.webflow.io/breaches/angelsense-data-leakUpGuard can now report that it has secured an Elasticsearch database for AngelSense, a GPS tracker for children and adults with special needs.Mon, 23 Jun 2025 04:51:01 GMThttps://upguard-staging.webflow.io/breaches/campaign-sidekick-git-data-leakhttps://upguard-staging.webflow.io/breaches/campaign-sidekick-git-data-leakThe source code for a voter contact app was left publicly accessible, exposing credentials, code, and the app's development history. Wed, 20 Nov 2024 06:50:40 GMThttps://upguard-staging.webflow.io/breaches/tvsmiles-european-mobile-advertising-app-personal-datahttps://upguard-staging.webflow.io/breaches/tvsmiles-european-mobile-advertising-app-personal-dataData from TVSmiles, a German mobile application for delivering gamified advertisements, exposed a database including personally identifiable information.Wed, 20 Nov 2024 06:50:23 GMThttps://upguard-staging.webflow.io/breaches/pta-databasehttps://upguard-staging.webflow.io/breaches/pta-databaseOn May 13th, UpGuard discovered a new set of data recently posted on a prominent dark web forum, this time allegedly belonging to the National Parent Teacher Association.Wed, 20 Nov 2024 06:36:57 GMThttps://upguard-staging.webflow.io/breaches/encollecthttps://upguard-staging.webflow.io/breaches/encollectUpGuard can now report an ElasticSearch instance used as data storage for the debt collection system ENCollect has been secured. The server contained data about loans from multiple Indian and African financial services companies that had apparently been sent to ENCollect for collection. The data totalled 5.8GB in storage size and contained a total of 1,686,363 records. Those records included personal information like name, loan amount, date of birth, account number, and more.Wed, 20 Nov 2024 06:36:57 GMThttps://upguard-staging.webflow.io/breaches/smarterselecthttps://upguard-staging.webflow.io/breaches/smarterselectUpGuard can now report that a public Google Cloud Storage bucket containing approximately 1.5 terabytes of data used to administer funding programs for college students has been secured. The bucket belonged to SmarterSelect, a company that provides software for managing the application process for scholarships, grants, and awards. The more than 2.8 million files included documents like transcripts, resumes, personal essays, tax returns, and invoices for approximately 1.2 million applications to funding programs.Wed, 20 Nov 2024 06:36:57 GMThttps://upguard-staging.webflow.io/breaches/power-appshttps://upguard-staging.webflow.io/breaches/power-apps38 million records were exposed in multiple data leaks resulting from misconfigured Microsoft Power Apps portals. Data included sensitive information such as COVID-19 contact tracing data, COVID-19 vaccination appointments, social security numbers for job applicants, employee IDs, and millions of names and email addresses.Wed, 20 Nov 2024 06:36:57 GMThttps://upguard-staging.webflow.io/breaches/martin-county-florida-election-officials-passwordshttps://upguard-staging.webflow.io/breaches/martin-county-florida-election-officials-passwordsUpGuard can now disclose that an Amazon S3 storage bucket containing publicly exposed backups of systems representing the intranet and web presence for Martin County, Florida has been secured.Wed, 20 Nov 2024 06:36:57 GMThttps://upguard-staging.webflow.io/breaches/medibank-data-leakhttps://upguard-staging.webflow.io/breaches/medibank-data-leakA comprehensive breakdown of all the events unfolding from the Medibank data breach.Wed, 20 Nov 2024 06:29:45 GMThttps://upguard-staging.webflow.io/breaches/cloud-leak-birsthttps://upguard-staging.webflow.io/breaches/cloud-leak-birstAnalytical software provider Birst exposed an appliance in an S3 bucket.Wed, 20 Nov 2024 06:29:45 GMThttps://upguard-staging.webflow.io/breaches/cloud-leak-octolyhttps://upguard-staging.webflow.io/breaches/cloud-leak-octolyUpGuard has discovered a cloud leak from Paris-based digital marketing startup Octoly exposing the personal details of thousands of social media personalities. Wed, 20 Nov 2024 06:29:45 GMThttps://upguard-staging.webflow.io/breaches/digital-gangsters-disinformation-dark-adverts-uk-parliament-dcms-reporthttps://upguard-staging.webflow.io/breaches/digital-gangsters-disinformation-dark-adverts-uk-parliament-dcms-reportBased on UpGuard's data breach research, the UK Parliament’s DCMS Committee prepared and published the final report detailing their 18 month investigation into online disinformation and the privacy practices of platforms such as Facebook. Read about the report, and the AggregateIQ breach discovery.Wed, 20 Nov 2024 06:29:44 GMThttps://upguard-staging.webflow.io/breaches/enterprise-scale-how-credentials-leaked-from-public-storage-bucketshttps://upguard-staging.webflow.io/breaches/enterprise-scale-how-credentials-leaked-from-public-storage-bucketsSeveral large storage buckets under the control of Hortonworks were configured for public access, exposing credentials and other internal data. Wed, 20 Nov 2024 06:26:56 GMT