Massive 4TB EY Database Backup Found Publicly Accessible on Azure

A complete 4-terabyte SQL Server backup belonging to Ernst & Young (EY) was found publicly accessible on Microsoft Azure, a vulnerability identified by security researchers during routine internet mapping and subsequently remediated following responsible disclosure.

According to Ernst & Young (EY), the exposure occurred in a cloud storage bucket and the file appeared to be a full database export containing schemas, stored procedures, and potentially sensitive data including API keys, session tokens, user credentials and authentication tokens. Verification was done by examining header signatures rather than downloading the entire dataset, with a HEAD request to the Azure storage bucket triggering metadata that pointed to a 4-terabyte object.

The discovery underscored a common cloud risk: attackers deploy broad scanning infrastructure to find misconfigured buckets and exposed databases, with the window between exposure and exfiltration often measured in seconds. EY’s incident response was described as rapid and professional, with remediation completed within one week, following guidance and disclosure during the process that highlighted broader visibility gaps in cloud infrastructure. The article notes a prior fintech incident where a database backup was publicly exposed for about five minutes and the dataset was exfiltrated.