Not every breach involves a hacker. Some of the most damaging ones are simply a setting left in the wrong position. A regional e-commerce business found this out when a security researcher emailed to say its customer database had been sitting open to anyone with the link for the better part of a year. No malware, no break-in, just one cloud setting on the wrong value.

The setup

To move quickly, a developer had spun up a cloud storage bucket to hold database backups and customer export files. During testing it was set to “public” so a script could reach it easily. The project shipped, the team moved on, and the public setting was never changed back. Roughly 12,000 records, including names, emails, addresses, and order history, sat in a folder that anyone could open if they found the address.

The trigger

Researchers and criminals alike run automated tools that scan for open cloud storage all day long. One of them indexed the bucket. The business was lucky that an ethical researcher found it first and reported it. Many companies in the same position only learn about the exposure when the data shows up for sale.

Why it worked

• A default left on “public.” Convenient during testing, dangerous in production.
• No inventory of cloud resources. Nobody owned a list of what existed and how it was configured.
• Sensitive data with no extra protection. The files were not encrypted or access-restricted beyond the bucket setting.
• No monitoring. There was no alert when the storage was made public or when it was accessed from the outside.

The fix, and what it would have cost

A short cloud configuration review, a simple inventory of what data lives where, and a rule that production storage is private by default would have caught this in minutes. Instead the business faced breach notification obligations, legal review, and the lasting trust cost of telling 12,000 customers their information was exposed. The cleanup cost far more than prevention would have.

If your business uses any cloud service, and almost every business does, knowing what is exposed is step one. A quick assessment is the fastest way to find out.