3.2 Million Files Revealed on AWS S3 Bucket

A Los Angeles County nonprofit that provides health and human services accidentally exposed about 3.2 million files on an unsecured AWS S3 bucket, according to the UpGuard cyber risk team. 211 LA County, a nonprofit organization serving LA County, was reportedly left publicly exposed online. The content revealed in the downloadable files was widespread. In addition to access credentials for the 211 system operators and email addresses for contacts, "included in the more than 3 million rows of call logs are 200,000 rows of detailed notes," UpGuard wrote in a 17 May post. The call notes included personally identifiable information for people reporting the problem. Among those were “persons in need, and, where applicable, their reported abusers, including graphic descriptions of elder abuse, child abuse, and suicidal distress, raising serious, large-scale privacy concerns,” according to UpGuard. The information, stored in an Amazon AWS S3 bucket located at the subdomain “lacounty,” was inadvertently misconfigured to be publicly and anonymously accessible, according to UpGuard. “Though some of the files in the bucket were not publicly downloadable, those that were included Postgres database backups and CSV exports of that data, with hundreds of thousands of rows of sensitive personal information,” the UpGuard post stated.