EY Exposes 4TB SQL Server Backup Publicly on Microsoft Azure

A massive 4TB SQL Server backup belonging to Ernst & Young (EY) was publicly accessible on Microsoft Azure, according to SecurityAffairs. The exposed file, a .BAK backup, was discovered by Neo Security during a routine scan and was described as potentially containing sensitive data such as schemas, user information, API keys, credentials and authentication tokens. Initial checks suggested the backup was unencrypted, with analysts confirming risk after downloading only a small amount of data.

EY was linked to the file through merger documents and a DNS SOA lookup, with Neo Security noting that the domain owner appeared to be ey[.]com. EY subsequently remediated the exposure, and SecurityAffairs reports that no client or confidential data was affected. The incident underlines how even large organisations can leave massive data exposures online in fast-moving cloud environments, underscoring the need for continuous cloud visibility and automated leak detection. The report appeared on 31 October 2025.