- Ransomnews counted 484,142 publicly listable cloud storage buckets in October 2026. Many are open on purpose, so the figure is not a count of breaches.
- Names and file types point to where sensitive material concentrates, including 80,495 .env files, 67% of them last written in 2026. No files were opened, so these are ceilings, not confirmed secrets.
- Turn on account-level public-access blocks, search your own storage for secret file types, and rotate any secret that sat in an open bucket.
The attacker's first tool is a search box
Ransomnews researchers counted 484,142 cloud storage buckets that anyone could list in October 2026. Together they held 18.05 billion files. The team found them through commercial search engines that index open cloud storage. A bucket is simply a named container for files in the cloud.
Here is the argument this index supports. For exposures like these, finding the door takes one search. Search engines have turned discovery into a query. The index is a single snapshot and shows no trend. Ransomnews itself says nothing in it is new, and that every provider has offered an account-level switch for years.
The numbers need care. Many of these buckets are open on purpose. They hold website images, open datasets and podcast archives. Ransomnews says the index is not a count of breaches. It describes the group of buckets in which the breaches sit.
What the names give away
The researchers downloaded and opened no file. Their raw material was limited to what a search engine returns: how a bucket is named, what its files end in, how many files it has and when each was last changed. Ransomnews says that was enough to see where sensitive material concentrates.
Amazon S3 holds 347,984 of the open buckets, or 71.9%. Ransomnews says that roughly tracks market share and is not evidence that S3 is configured worse. The picture shifts when you look at names. Azure Blob has 14.2% of all open buckets. Yet it accounts for 37% of the 1,459 buckets with "backup" in the name, 42% of 399 named for exports, and 51% of 505 with HR or payroll terms.
Buckets named "dev" sit at Azure's baseline of 15%. Ransomnews offers a hypothesis: Azure storage is more often used for business data such as backups and HR systems. It says the counts suggest this but do not prove it. It plans to test it in the next run.
Names tied to regulated sectors appear on 10,891 unique open buckets. Those sectors are finance, healthcare, education, government, legal and HR. Within healthcare, matching names cover 2,709 buckets and 47.9 million files. Matching is by substring, so these are name signals, not confirmed owners.
Files that exist to grant access
The most useful figures are about file types. Ransomnews found 321,058 credential and key files in open buckets. Each type exists to unlock something.
Developers keep database passwords and API keys in .env files. The index lists 80,495 of them, and 54,317 (67%) were last written in 2026. Ransomnews reads that as buckets in active use, not forgotten archives. A .tfstate file is Terraform's record of a whole cloud estate, often with secrets in plain text. A .kdbx file is an encrypted KeePass password vault. Once it is downloadable, anyone can try passwords against it offline.
The researchers set a limit on all of this. Certificates make up part of the 113,285 .pem files, and test fixtures sit among the rest. Treat each count as an upper bound on live secrets. It does not tell you how many work.
Two problems with different owners
The dates split the findings in two. Ransomnews found that 89% of the 752,055 .bak backups were last written before 2025. It calls that a governance problem: buckets left open for years. The .env files are the live problem, because the secrets inside may still work.
New files keep arriving. Measured against the newest file in the index, Ransomnews says at least 113.6 million files landed in listable buckets during the prior seven days. In the 30 days to that date, it counted 21,125 SQL dumps and 1,298 .env files.
Timing is a limit. Ransomnews queried the search engines on 25 October. Its bucket list was accurate to 7 October. Its newest file was dated 9 September. So the file-level numbers describe a world about a month older than the bucket list.
Questions to put to your team
Ransomnews recommends a short list. We would turn it into questions you can ask this week.
First, is public access switched off at the account level? Ransomnews names three controls: Block Public Access on Amazon S3, a ban on anonymous blob access for each Azure storage account, and public access prevention on Google Cloud. Set at the organisation or account level, they stop a new bucket from opting out.
Second, has anyone searched your own storage for secret-bearing files? Ransomnews lists .env, .sql, .bak, .pem, .ppk, .tfstate and .kdbx, and says none belong in a bucket that serves a website. The same search engines will show what the internet already sees.
Third, if a secret ever sat in an open bucket, has it been rotated? Ransomnews puts it plainly: "Closing the bucket does not un-leak the key." It advises assuming anything listable was copied.
The lesson here is that exposure is a question of inventory. An attacker needs one search. A defender needs to know every bucket the company owns.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: ransomnews.com.
