2023 Unprotected Elasticsearch — 3.8B records
Data compromised
Email addresses, passwords from prior breaches
Technical writeup
Digital risk protection firm left Elasticsearch and Kibana interface unprotected. Email and password combinations from prior breaches aggregated for customer alerts. 16 collections of ~240M records each. Researcher Bob Diachenko discovered and alerted; secured immediately.
Root cause
Unprotected database; failure to password-protect Elasticsearch/Kibana.