Thousands of Amazon S3 buckets left open exposing private data

A Rapid7 researcher found a misconfiguration in Amazon’s Simple Storage Service (S3) that many organizations have their buckets (where the data is stored) made available to the public. During Rapid7’s research they reviewed the permissions of approximately 13,000 Amazon S3 buckets and uncovered more than 28,000 PHP source files. Some contain details such as database usernames, passwords, and API keys. Also, 218,000 CSV files were identified, many of which expose personal information such as names, email addresses, and phone numbers. Many of the documents identified were clearly marked as confidential or obviously private in nature. In other instances, the exposed data included log files and service data that exposed sensitive details about the organization and their customers.