EY exposes 4TB+ SQL database to open internet for who knows how long

A Dutch cybersecurity outfit says its lead researcher recently stumbled upon a 4TB+ SQL Server backup file belonging to EY exposed to the web, effectively leaking the accounting and consulting megacorp's secrets.

Among the BAK file's data were API keys, cached authentication tokens, session tokens, service account passwords, and user credentials, Neo Security's writeup explained.

"Finding a 4TB SQL backup exposed to the public internet is like finding the master blueprint and the physical keys to a vault, just sitting there," it said. "With a note that says 'free to a good home.'

"[The lead researcher had] investigated breaches that started with less. Way less. He once traced an entire ransomware incident back to a single web.config file that leaked a connection string. That was 8 kilobytes. This was four terabytes."

The researcher, who was not named in the company's report, downloaded the first thousand ...