The 4TB time bomb: when EY’s cloud went public (and what it taught us)

The 4TB time bomb article recounts the discovery of a 4 TB SQL backup exposed to the public internet, which, according to Neo Security, contained every secret stored in the database, including API keys, session tokens and user credentials.

Neo Security explains that a SQL Server BAK file holds the complete database, and that such a dump left accessible is like a master blueprint with a note saying “free to a good home.” An SOA lookup pointed to ey[.]com, the domain of Ernst & Young, linking the incident to one of the Big Four firms. According to Neo Security, EY’s handling of the notification was praised as “textbook perfect” in terms of acknowledgement and incident response, with the issue triaged and fully remediated a week later.

However, EY reportedly faced difficulties finding a means to receive third‑party alerts during the incident, as there was no security mailbox, vulnerability disclosure program or similar contact listed on their home page or robots.txt. The article calls for EY to model better awareness for clients by providing 24/7 contact options for urgent security issues, noting Cybersecurity Awareness Month ongoing at the time.