Ernst & Young Left 4TB of Its Own Database on the Open Internet. Here Is How You Avoid Being Next.

01 The one-request breach

The file extension and the magic bytes, the first few bytes that fingerprint a file's format, identified it as a .BAK: a native SQL Server backup. The researcher pulled just the first 1,000 bytes to confirm the file was not encrypted, and stopped there. Downloading the whole thing would have crossed a legal line. Confirming the format did not [ The Register 2025 ] .

Ownership took a little detective work. A DNS SOA lookup on the storage endpoint resolved back to ey.com, and merger documents inside the metadata, written in a south-central European language and run through DeepL, confirmed it. The bucket had no owner label. The data spoke for itself. From first anomaly to attribution, this was the work of one analyst and a handful of low-level requests.

02 Not a backup. A keyring.

A leaked database is bad. A leaked database backup is worse, because a backup is a frozen copy of everything, including the things production systems keep in memory and rarely write down. This one held far more than records [ Cyber Security News 2025 ] .

Read that second column again. Every item is a way to authenticate somewhere else. The backup was the ignition key to a wider intrusion. An attacker who pulled the full 4TB would not have needed to break anything after that. They would have logged in, using EY's own valid tokens, and looked like normal traffic doing it. Service accounts are the quiet danger: they rarely rotate, they rarely carry MFA, and they often hold standing access to production.

03 Fifteen calls, unanswered

Here is the detail that should stay with any security leader. The researchers tried to warn EY through responsible disclosure. It took 15 separate attempts to reach the right team before anyone acted [ Security Affairs 2025 ] . Fifteen. A firm this size, and the front door for a good-faith warning was that hard to find.

Now flip the scenario. A criminal who found the same bucket sends zero emails. They copy the data and go quiet. The disclosure friction that slowed a friendly researcher by days is friction an attacker never encounters. Your exposure window is not measured from when you are told. It is measured from the moment the asset went public, and for a bucket discoverable by routine scanning, that clock started long before anyone called.

EXPOSURE WINDOW

To EY's credit, once the message landed, the response was fast. The company confirmed the exposure, remediated it inside about a week, and stated that no client information, personal data or confidential EY data was affected. A clean, quick close. EY handled the aftermath well. The point is that the aftermath should never have been needed.

04 Why nothing flagged it

EY runs a mature security programme. It has scanners, policies and a CSIRT. None of that saw a 4TB backup go public, and you should understand why, because the same blind spot is probably in your pipeline. Internal scanners look inward. They check the assets you told them about, inside the perimeter you defined. A storage bucket spun up during a cloud migration, set to public by a default or a hurried click, is not on that list. It is outside the map, which is exactly why it is dangerous.

Cloud migrations are where this class of failure breeds. Data moves fast, access settings are copied loosely or reset to permissive defaults, and encryption at rest gets skipped to hit a deadline. A better scanner would not have caught EY's bucket. A change of viewpoint would: someone standing outside the firewall, enumerating what the world can actually see, continuously, the way an adversary does.

05 What to fix this quarter

This failure maps cleanly onto the frameworks your board already answers to. ISO 27001 Annex A calls for cryptographic controls and asset management. NIST CSF puts Identify before Protect for exactly this reason. For a regulated firm, an unencrypted backup of credential material on the public internet is a reportable event under GDPR and, for financial entities, a resilience gap DORA now expects you to have tested for. The work below is what closes the gap.

One HTTP request is all it took to find 4 terabytes of a Big Four firm's most sensitive material on the open web. Your estate deserves the same look from your side before a scanner on someone else's finds it for you. We run a first-look scan of your external attack surface and hand you the exposed assets in plain terms, with a fix list your team can action this quarter. Enterprise-grade. Not enterprise-priced. Start with your Threat Map.