nagwww/s3-leaksCurated timeline of AWS S3 bucket misconfigurations, exposed data, and leaked IAM credentials, with incident links for cloud security defenders and researchers.
Feel free to send in a PR if you know of other leaks
| Date | Description | Notes |
|---|---|---|
| April 2025 | Thoughts of AWS Access key ID's from an S3 bucket | The keys to the AWS kingdom |
| March 2025 | 16,000 subscribers to Nine newspapers from Australia | name, postal address and/or email address |
| Jan 2025 | North Dakota-based TV station Valley News Live had more than 1.8 million files | Over a million of the exposed files were applicants' resumes and CVs containing names, phone numbers, home and email addresses, birthdates, employment histories, educational backgrounds |
| Jan 2025 | WebWork - tracking remote workers' time and productivity and billing services | 13 million logs and screenshots |
| Dec 2024 | operation that scanned millions of websites, exploiting vulnerabilities in improperly configured public sites | |
| Nov 2023 | MTC is a governmental agency responsible for regional transportation planning and financing in the San Francisco Bay Area. | PDF files with Bay Area Rapid Transit (BART) carpool parking permits users' full names and home addresses |
| Oct 2023 | India’s national logistics portal exposed sensitive personal data, trade records | Exposed sensitive personal data and various state and private trade records. |
| Sep 2023 | WBSC, headquartered in Switzerland, was established in 2013 | bucket storing nearly 48,000 files.copies of 4,600 national passports. |
| Setp 2023 | PricewaterhouseCoopers' (PwC) Nigeria confidential data was stolen | The 24,668 exposed files include: Copies of passports/government-issued IDs Resumes with phone numbers, home and email addresses, and other private information Copies of degree/university certificates |
| August 2023 | MPD FM, a facility management and security company providing services to various UK government departments | Passports/ VISAs/ National IDs/ Driving licenses/ Birth certificates/Vetting reports Right-to-work/ checks /Job contracts /Proof of address / Bank statements |
| May 2023 | London-based outsourcing giant Capita | exposed to the internet since 2016, contained approximately 3,000 files totaling 655GB in size |
| Jan 2023 | Pegasus Airlines Leaked 6.5TB of Data in AWS S3 Bucket Mess Up | Airlines Leaked 6.5TB |
| Aug 2022 | Cloud Misconfig Exposes 3TB of Sensitive Airport Data in Amazon S3 Bucket: 'Lives at Stake' | That is sure a lot of data on S3 |
| July 2022 | McGraw Hill's S3 buckets exposed 100,000 students' grades and personal info | 22 TB of data and over 117 million files |
| Aug2020 | S3 bucket mess up exposed 182GB of senior US, Canada citizens data | The misconfigured S3 bucket was owned by SeniorAdvisor, a consumer ratings and reviews website. |
| July2020 | Twilio: Someone broke into our unsecured AWS S3 silo, added 'non-malicious' code to our JavaScript SDK | Attackers tried to update the javascript library hosted on the s3 buckets so this can be picked up by other clients |
| Jan 2020 | "Exposed AWS buckets again implicated in multiple data leaks" | Passport scans, tax documents, background checks, job applications, expense claims, contracts, emails and salary details relating to thousands of consultants working in the UK were exposed. |
| June 2020 | "7.2 million records were exposed, but not from the BHIM app" | |
| Oct 2018 | Misconfigured database breaches thousands of MedCall Advisors patient files | names, email and postal addresses, phone numbers, dates of birth and Social Security numbers. Other files had recordings of patient evaluations and conversations with doctors, along with medications, allergies and other detailed personal health data. |
| Jun 2019 | AWS S3 server leaks data from Fortune 100 companies: Ford, Netflix, TD Bank | Attunity, an Israeli IT firm that provides data management, warehousing, and replication services for the world's biggest companies, has exposed some of its customers' data after it left three Amazon S3 buckets exposed on the internet without a password. |
| May 2019 | How a Vendor for Half the Fortune 100 Exposed a Terabyte of Backups | |
| Mar 2018 | Medical Records and Patient-Doctor Recordings Were Exposed | information for employees of 181 business locations, as well as personally identifiable information (PII) for nearly 3,000 individuals was publicly exposed in an unsecured |
| Mar 2018 | Jewelry site accidentally leaks personal details (and plaintext passwords!) of 1.3M users | addresses, zip-codes, e-mail addresses, and IP addresses. He also claims the database contained plaintext passwords |
| Feb 2018 | S3 bucket open to world : Octoly | real names, addresses, phone numbers, email addresses |
| Jan 22 | Sensitive medical records on AWS bucket found to be publicly accessible | |
| Dec 2017 | Alteryx leave S3 bucket open for anonymous user : 120m american households exposed | Home addresses, contact information, mortgage status, financial histories |
| Nov 2017 | 111 GB of internal customer information from National Credit Federation, a Tampa, Florida-based credit repair service | - SSN - Drivers licesne, credit reports |
