Fast Facts

• Ernst & Young (EY) faced a potential leak of 4 TB of SQL backup data on Microsoft Azure, accessible without authentication.
• The exposed file could have contained sensitive items like service credentials, API keys, and authentication tokens.
• The incident was tied to an Italian entity EY had recently acquired, not the global EY infrastructure.
• No evidence of malicious access was found, but the exposure lasted up to a week before being secured.
• Experts warn that even brief exposures can be exploited by automated bots scanning the internet nonstop.

A Digital Gold Rush: When Data Goes Public

Picture a vast digital landscape, where every cloud server and storage bucket is a potential gold mine. In this world, armies of automated bots-much like mechanical prospectors-scour the terrain day and night, searching for the tiniest crack in the vault. That’s precisely what happened when researchers stumbled upon a 4-terabyte backup file from Ernst & Young (EY), sitting wide open on Microsoft’s Azure cloud, just waiting to be discovered.

The discovery was made not by chance, but as part of a systematic “attack surface mapping” by Neo Security and Recorded Future, cybersecurity firms that chart out the digital exposure of major organizations. Their scan revealed a .BAK file-essentially a backup snapshot of a large database-accessible to anyone, with no password required. A simple HTTP request confirmed its colossal size. Further analysis tied the storage to EY’s domain, specifically an Italian subsidiary recently brought under EY’s wing.

How a Simple Mistake Can Become a Catastrophe

The root cause? A misconfigured Access Control List (ACL)-the digital equivalent of leaving a bank vault wide open because the lock was set to “public” by default. This mistake likely occurred during an automated backup process, a risk that grows as companies juggle dozens of cloud systems, especially after mergers and acquisitions. Although EY acted quickly-securing the data within about a week and finding no evidence of theft-the incident highlights a critical vulnerability: in the cloud, every second counts.

As Neo Security’s analysis points out, today’s attackers don’t wait for invitations. Vast botnets-networks of compromised computers-scan the entire internet in minutes, instantly finding and copying exposed data. Even a five-minute lapse, as seen in a previous fintech breach, can be enough for sensitive information to be stolen and traded on underground markets. The line between “safe” and “compromised” is now measured in seconds.

The Bigger Picture: Lessons from EY’s Exposure

EY’s official statement downplayed the risk, emphasizing that no client or confidential global data was affected and that the exposure was isolated to an acquired Italian entity. But the real lesson lies deeper: every acquisition brings hidden digital baggage, from outdated policies to forgotten servers. If these aren’t swiftly brought up to strict standards, they become blind spots-perfect targets for cybercriminals.

This isn’t an isolated case. Similar public cloud exposures have hit companies like Capital One and Facebook in recent years, often due to the same root cause-misconfigured cloud storage. Regulators and cybersecurity experts now urge organizations to continuously audit their cloud assets, deploy automated tools to spot risky configurations, and maintain a real-time map of every digital asset they own.

As Recorded Future warns, for firms like EY that handle sensitive financial and audit data, even a near-miss can bring regulatory headaches and lasting reputational harm. The message is clear: you can’t protect what you don’t know you have.

WIKICROOK

• Access Control List (ACL): An Access Control List (ACL) is a set of rules that determines which users or systems can access specific digital resources and what actions they can perform.
• Cloud Storage Bucket: A cloud storage bucket is an online folder for storing and managing files in the cloud, which can be set as private or public for access.
• SQL Backup (.BAK file): An SQL Backup (.BAK file) is a full copy of a database used for recovery. If exposed, it can reveal sensitive organizational or personal data.
• Botnet: A botnet is a network of infected devices remotely controlled by cybercriminals, often used to launch large-scale attacks or steal sensitive data.
• Attack Surface Mapping: Attack Surface Mapping identifies all possible digital entry points an attacker could use to access an organization’s systems, aiding in risk reduction.