Researchers Find 18 Billion Files in Exposed Cloud Buckets

42 publicly listable cloud buckets containing 18 billion files were counted by the Ransomnews research team in October 2026, with the count derived from open cloud storage indexed by search engines and published as the Ransomnews Cloud Exposure Index. The researchers emphasise that no files were opened; they used bucket names, file extensions, counts and last-modified timestamps to identify where sensitive material may reside.

The dataset shows 484,142 open buckets, hosting 18.05 billion files, with Amazon S3 accounting for about 72% of exposed buckets, Azure Blob 14.2%, Google Cloud Storage 11.0%, DigitalOcean Spaces 2.3% and Alibaba OSS 0.7%. The snapshot date is 7 October 2026, with indexing performed up to 25 October and file-level data reflecting the period up to 9 September 2026; counts are capped at one million per query, meaning larger categories were split into date ranges.

The exposure includes 321,058 credential- and key-related files, including 80,495 .env files and 113,285 .pem files. File types exceeding one million entries include database dumps and backups such as 2,561,807 SQLite databases, 752,055 .bak backups, 106,191,393 PDFs and 69,580,112 CSV exports, among others. Sector analysis shows concentrations in regulated sectors (finance, healthcare, education, government, HR) and retail, with 10,891 exposed buckets in regulated categories.

The authors highlight that many buckets are publicly accessible by design (assets, open datasets, podcasts), and they urge enabling provider-wide access controls (S3 Block Public Access, Azure anonymous access restrictions, Google public access prevention) and scanning for sensitive files such as .env, .sql, .bak, .pem, .tfstate and .kdbx, while noting that closing a bucket does not erase previously copied data. The piece also notes limitations in date recency and index caps.