Ransomnews maps 484,142 open cloud buckets holding 18 billion files

Ransomnews counted 484,142 publicly listable cloud buckets holding 18,054,411,545 indexed files in October 2026. Mantas Sasnauskas is the author of the Ransomnews Cloud Exposure Index.

Researchers ran search-engine queries on Oct. 25, 2026 using a bucket list captured on Oct. 7, 2026, while the most recent file in the collection dates to Sept. 9, 2026. The numbers all derive from bucket names, file types, counts and timestamps of the last change, with no files opened by researchers. Ransomnews said, “No file was opened for this index.”

When bucket names point to backups, exports or payroll, Azure Blob turns up 2.5 to 3.6 times more often than expected. Retail and e-commerce lead all sectors with 5,666 exposed buckets holding storefront assets. Publicly listable buckets received at least 113.6 million file uploads in the week before Sept. 9, 2026.

The index includes five providers: Amazon S3 accounts for 347,984 open buckets at 71.9%, Azure Blob for 68,532 at 14.2%, and Google Cloud Storage for 53,131 at 11.0%. The database and dump tally runs to 687,446 .sql dumps, 752,055 .bak backups and 2,561,807 SQLite databases. The virtual disk category covers 2,959 VMware disks, 4,427 Hyper-V disks, 4,036 QEMU images and 10,161 virtual appliances. Over the 30 days leading up to Sept. 9, 2026, open buckets added 21,125 SQL dumps, 20,958 backups, 4,477 .pem files and 1,298 .env files.

Amazon’s share aligns with its market share, so the number alone does not show poorer bucket configuration. For backup-named buckets totaling 1,459, Azure Blob holds 37%, and it holds 42% of export-named buckets numbering 399. The provider also controls 51% of 505 buckets tagged for HR or payroll.

Logs, customer and database categories each hit 35% to 36% on Azure, roughly 2.5 times the baseline. Development buckets match the 15% baseline, while test and staging buckets sit lower at 9% and 7%. Researchers describe the operational-data pattern as a hypothesis suggested by the counts, not something the figures prove.

Finance, healthcare and education join government, legal and HR names on 10,891 distinct open buckets. Healthcare labels appear on 2,709 buckets containing 47.9 million files, using matches for hospital, patient, clinic and dental. HR and payroll rank as the smallest sector with 505 buckets, and Azure hosts 259 of them. These sector counts rely on name matching, not confirmed ownership, and one bucket can fall under two categories because of substring matching.

Open buckets hold roughly 4.7 million database and dump files. The index also enumerates 15,130 mailbox archives alongside a large volume of documents and spreadsheets. A single virtual disk image may contain a whole server along with its credentials.

The index lists 321,058 files containing credentials and keys. The collection includes 80,495 .env files, and 54,317 of them, or 67%, carry a 2026 last-change date, suggesting the buckets are actively used rather than abandoned.

The index lists 113,285 .pem files, with 28% dating to 2026 and 58% predating 2025, though some are public certificates. The index also lists 24,302 PuTTY private key files, and 97% of them date to 2024. .env files expose database passwords and API keys, .tfstate files frequently keep secrets in plain text, and attackers can guess .kdbx vaults offline.

Ransomnews links publicly exposed buckets to ransomware since initial access brokers sell public .env passwords, meaning attackers do not have to infect a device. Ransomnews says to rotate any secret kept in a public bucket, since closing the bucket does not erase the exposure.

Some buckets are intentionally public, storing website files, podcast archives, open datasets and CDN mirrors, which means the total is not a count of 484,142 breaches and the index names no individual bucket. File last-modified dates mark when content originated, not when it appeared online, and a bucket listing does not guarantee readers can access the material inside. Researchers cannot pull more than one million results in a single search, so they divide big categories by date range, which leaves some totals as minimums.

Ransomnews released the work as the Cloud Exposure Index and plans to repeat it every three months, so readers can compare the figures over time. Ransomnews said, “We are calling it the Ransomnews Cloud Exposure Index, and we will rerun it quarterly so the numbers can be compared over time.” For known owners in regulated industries, the process is responsible disclosure, and the process copies national CERTs when the owner is in the public sector or does not respond.

The report calls for account-level blocks such as Chiprook Block Public Access, no anonymous access to Azure Blob storage and Google Cloud public-access prevention, applied at the account or organization level so newly created buckets cannot turn public. Operators should scan storage for.tfstate,.kdbx,.ppk,.pem,.bak,.sql and.env files. Terraform state and virtual disk images should be treated as secret infrastructure: private, encrypted and monitored, and backups should be kept off public storage with recovery procedures tested.