The breach without a hacker: open databases
Researchers keep finding databases with millions of records and no password. Nobody broke in; the door was open.
Almost every week this year, researchers have reported another database left open on the internet: Elasticsearch, MongoDB, storage buckets, with millions of customer records and no password at all. Often it was a copy made for testing or analytics, forgotten.
No hacker needed. Search engines like Shodan index these within hours.
How to make sure it isn’t you:
- Databases never listen on public IPs. Bind them to private networks and use firewall rules.
- Authentication on, always, even for “temporary” or test instances.
- Scan your own public IPs and cloud accounts for open database ports and public storage.
- No production data in test copies, or mask it first.
- Delete copies when the analysis or migration is finished.
The fix is boring configuration. The breach notice is not.