Fast Facts

• Over 80,000 sensitive submissions found on public code formatting tools like jsonformatter.org and codebeautify.org.
• Leaked data includes passwords, API keys, banking KYC profiles, and government system scripts.
• Secrets from banks, governments, cybersecurity firms, and even stock exchanges were exposed.
• Attackers are actively scraping these sites, exploiting predictable link formats and public “Recent Links” pages.
• Security notifications to affected organizations were often ignored or met with silence.

The Hidden Dangers of Code Convenience

Imagine your house keys hanging on a public bulletin board, all because you wanted to tidy up your keychain. That’s essentially what’s happening in the digital world: developers, pressed for time, are pasting sensitive data into online tools that make messy code readable. These tools-designed for convenience-are quietly turning into treasure troves for cybercriminals.

WatchTowr Labs, a cybersecurity research group, recently shone a spotlight on this shadowy phenomenon. By scanning publicly accessible “Recent Links” pages on sites like jsonformatter.org, they unearthed a staggering volume of leaked secrets: passwords, cloud keys, customer records, and confidential scripts. The researchers didn’t need to hack anything; the data was sitting in plain sight, accessible through simple web requests to predictable addresses.

From Innocent Mistakes to Industry-Wide Risk

The problem isn’t new, but it’s escalating. For years, the cybersecurity community has warned about the dangers of copy-pasting sensitive info into online tools. In 2017, similar leaks were found via pastebin-like services, and in 2021, misconfigured GitHub repositories made headlines for exposing API keys. What makes the current wave alarming is the scale and diversity of victims: banks, stock exchanges, government agencies, and even cybersecurity vendors themselves.

The technical trick is simple. Online formatters often let users “save” their work, generating a public link for sharing. Many also keep a “Recent Links” page, listing all the latest uploads-sometimes hundreds of thousands, stretching back years. By combining these public lists with a bit of automation, researchers (and, worryingly, criminals) can scoop up vast quantities of confidential data. One test even showed that fake credentials planted by WatchTowr were accessed by unknown parties within 48 hours, proving that bad actors are watching.

Global Stakes: The Supply Chain Domino Effect

The implications go far beyond individual companies. When a managed security provider leaks a client’s credentials, or a government agency exposes internal scripts, the blast radius can affect entire sectors. Attackers can use these secrets to move laterally-jumping from one company to its partners, or from a compromised test environment to live production systems. With the global supply chain already under siege from ransomware and state-backed hackers, these accidental leaks are like leaving the warehouse doors wide open.

The market impact is real: leaks can trigger regulatory fines, erode public trust, and even disrupt critical infrastructure. Geopolitically, adversaries could exploit these exposures for espionage or sabotage, especially when government or financial secrets are involved.

WIKICROOK

• API Key: An API key is a unique code that lets programs access data or services. If not properly secured, it can pose a cybersecurity risk.
• PII (Personally Identifiable Information): PII is any information that can identify a person, like a name, address, or social security number, and must be protected to ensure privacy.
• Cloud Credentials: Cloud credentials are usernames, passwords, or keys that grant access to cloud services and resources, such as AWS or Google Cloud.
• Supply Chain Attack: A supply chain attack is a cyberattack that compromises trusted software or hardware providers, spreading malware or vulnerabilities to many organizations at once.
• JSON Formatter: A JSON Formatter is a tool that organizes raw JSON data into a readable format, making it easier to understand and debug, but avoid using it for sensitive data.