Accidental Data Leak
An accidental data leak is not an attack in the classic sense, but the consequences can look the same. Data becomes available to the wrong people through human error, bad configuration, wrong sharing, a public repository, open cloud storage, or mail sent to the wrong address.
Term
description · examples · notesAn accidental data leak is not an attack in the classic sense, but the consequences can look the same. Data becomes available to the wrong people through human error, bad configuration, wrong sharing, a public repository, open cloud storage, or mail sent to the wrong address.
Description
In practice it happens. Somebody sends a spreadsheet to the wrong recipient, leaves an API key in a Git commit, shares a folder with anyone who has the link, moves production data into a test environment, or opens a cloud bucket to finish something quickly. There is no bad intent, but the data ends up outside.
The trouble is that leaks like this are often found by somebody else, and not always somebody well meaning. An automated scanner, a journalist, a researcher, a competitor or an attacker. The organization is then no longer managing the event but explaining why it did not know its data was exposed.
Examples
- An employee sends a document with personal data to the wrong person because the address autocompleted.
- A GitHub commit contains an API key that scanners find minutes after it is published.
- Cloud storage holding a database backup is left publicly reachable through a wrong setting.
Notes
- Accidental does not mean without consequences.
- If a secret sits in code, a document, a backup or a log, it should be assumed that one day it will be copied to the wrong place.
Techniques
carried out with 2Techniques used to carry it out. Select one to open its page.
Defenses
countered by 10How it is defended against. Select one to open its page.