Amazon Simple Storage Service (S3) is 20 years old, and while simplicity was, as the name suggests, the original inspiration, it has since become a sprawling platform.

But that doesn’t mean simplicity and ease of use aren’t still core tenets of the storage service, according to Andy Warfield, vice president and distinguished engineer at Amazon Web Services (AWS).

Speaking to ITPro ahead of the anniversary, Warfield said simplicity is still the “singular most important aspect” of S3. When it launched in 2006, a brief blog post outlined the core goal: “Amazon S3 is the storage for the internet”.

With a simple Representational State Transfer (REST) interface, users could PUT (store objects) and GET (retrieve them later) with relative ease. Warfield told ITPro that “parking the service” behind this architecture made it simple and easy for customers to adopt.

“At the time S3 launched in 2006, a lot of the verbs that we were using and a lot of the ways that the team approached presenting storage [were] actually really guided by the existing HTTP verbs,” he explained. So things like the GET and PUT support.”

“It made it incredibly easy to adopt. I think one thing that kind of taught the team, and it’s been true through the lifetime of S3, is that we do best when we focus on the customer, which you hear from us all the time, but on delivering for the customer in a way that is as simple as possible to consume so folks don’t have to do extra work.“

An explosion of growth for Amazon S3

To say Amazon S3’s growth over the last two decades would be a gross understatement. When it launched in 2006, S3 offered a total of one petabyte of storage capacity, spread across several hundred storage nodes in three data centers – it also had a maximum object limit of 5GB.

Compare that to 2026, and the numbers are jarring. As ITPro reported at AWS re:Invent 2025, the service now offers a maximum object size of 50TB, marking a ten-fold increase on the original limit.

Additional figures detailed by the company emphasize the sheer scale of S3 compared to its early days. Today it boasts:

• 500 trillion stored objects globally
• 200 million data requests per second
• 123 Availability Zones worldwide
• 39 AWS Regions

S3’s rapid-fire growth coincided with – and benefited from – an enterprise data explosion during the late 2000s and early 2010s. Indeed, Warfield notes that in 2006, you would have been “hard pressed to find something that you wanted to put in an object that was larger than 5GB”.

But with growing camera resolutions as a simple example, the rapid accumulation of enterprise data, and the formation of data lakes, demand surged. In 2026, Warfield admits the numbers are still rather mind-boggling.

“One that stands out to me is that the service processes over a quadrillion requests every year,” he said.

“We have tens of thousands of customers who, each individually, have objects that are spread over more than 10 million hard drives,” Warfield added, noting that the prospect of an individual enterprise building a storage setup of that scale as a “wild thing to think about”.

Underpinning enterprise innovation

Amazon S3 quickly moved beyond being a simple object storage service. Indeed, it became the underpinning foundation and enabler of customer data innovation.

The service helped kickstart the creation and subsequent growth of data lakes, and today, more than one million of these are stored on AWS. Warfield described this as a “structural aspect of why S3 is successful”.

Enabling enterprises to host data in a single source and all in one place helped break down long-running siloes that many had battled for years. It created a “shared foundation” for data.

“The data gives them this incredible flexibility and velocity to move quickly. And the data ends up being non-zero sum in terms of future value,” he said, reflecting on discussions with one particular customer.

“They often find that data they built for one system allows them to move into another opportunity.”

S3 in the age of AI

S3’s flexibility in adapting to customer demands over the last 2o years has been a key factor in its longevity and success - along with that of the company at large. AWS still boasts a large hyperscale market share o alongside Google Cloud and Microsoft Azure, for example.

With the advent of generative AI raising the stakes for big tech providers, the storage service is once again evolving to accommodate skyrocketing storage demands.

Indeed, the company is heavily focused on positioning S3 as the critical foundation for AI workloads. At AWS re:Invent in December, the company officially cut the ribbon on S3 Vectors, which has generated significant excitement across the company.

When it comes to AI, vector search is used to identify similarities between specific data points. At the time, the company described vectors as a "numerical representation of unstructured data created from embedding models".

Uploading, storing, and querying vectors is costly, though which is something this particular service aims to remedy. The company claims it can reduce costs on this front by up to 90%.

“The thing that we really wanted to do with S3 Vectors was to get a vector indexing service that had the simplicity and elasticity of S3 that you could just pick it up and use it with just ten vectors, but scale to billion and trillions of vectors and pay something that was closer to storage costs because it was anchored on hard drives,” Warfield explained.

“We’ve seen incredible growth on it.”

FOLLOW US ON SOCIAL MEDIA

Amazon Web Services (AWS) hosted its latest AWS Summit this week in New York, and the importance of AI for the company was manifest in its announcements.

While the first 20 years of its existence and success has been firmly rooted in the cloud, like all of its rivals and many more companies that wouldn’t be considered direct competitors it has turned its attention to riding the generative AI wave.

With the advent of agentic AI, the latest industry buzzword, the situation for AWS is no different.

So without further ado, these are the three most important announcements to come out of AWS Summit New York 2025.

Amazon Bedrock AgentCore

Two of the key concerns around AI agents and generative AI in business are security and governance. Can organizations be certain that the AI service they’re using isn’t leaking data and that data is stored and accessed in a way that complies with regulations, such as GDPR for example.

AgentCore, the latest addition to AWS’ managed generative AI service Amazon Bedrock, aims to solve these issues as well as maintaining reliability all while ensuring the agents can continue to operate autonomously.

AgentCore is composed of seven different services. These include Gateway, which provides AI agents access to tools like APIs and Lambda functions securely, and Browser Tool, which (as the name would suggest) allows agents to securely access websites through a cloud-based browser.

Meanwhile, Memory lets developers create context-aware agents with long-term and short-term memory.

According to AWS, all this aids developers in moving an AI agent from proof of concept to an application that can scale for millions of users.

AI Agents and Tools in AWS Marketplace

If you don’t have the capacity or desire to build your own agents, but still want to take advantage of agentic AI, this second key announcement is for you.

During his keynote, Swami Sivasubramanian, AWS VP for Agentic AI, said the cloud computing giant is on a mission to improve access to AI agents for enterprises.

“Building specialized agents in-house requires expertise across multiple domains, not just from large language models, but also with specific business functions,” he said.

“No organization can be an expert in everything – nor should they be – and just as today’s software ecosystem thrives on third-party APIs, tomorrow's AI agents will need to integrate specialized capabilities from across organizations, providers and systems.”

Key to driving access here is the new AI Agents and Tools service in AWS Marketplace. The offering will allow customers to “discover, buy, deploy, and manage AI agents and tools from leading providers”, according to AWS.

Anthropic, Brave, Snowflake, IBM and Agentforce were all named during Sivasubramanian’s keynote, among others.

Amazon S3 Vectors

The final of our top three most important announcements is Amazon S3 Vectors, which most obviously marries together AWS’ cloud storage pedigree with its AI pivot.

S3 Vectors is a cloud object storage offering with native vector support for AI workloads. According to AWS, it can reduce the cost of storing and querying vectors by “up to 90% compared to conventional methods.

It also integrates with Amazon Bedrock Knowledge Bases and OpenSearch Service, which, the company claims, streamlines and reduces the costs of RAG and vector search operations.

In his keynote, Sivasubramanian said the service was “ideal for infrequent query workloads like batch processing and non-real time agentic apps”.

MORE FROM ITPRO

• Pegasystems teams up with AWS to supercharge IT modernization
• AWS wants to drastically cut down AI hallucinations – here's how it plans to do it
• Global cloud spending might be booming, but AWS is trailing Microsoft and Google

Hackers who were able to steal data belonging to two AWS customers used the platform’s encryption capabilities to conduct a novel type of ransomware attack, researchers have warned.

A new report from cyber resilience firm Halcyon’s RISE team identified a new ransomware campaign targeting Amazon S3 buckets, where the attackers leverage AWS’ server-side encryption along with the Customer Provided Keys (SSE-C) to encrypt victim data.

The group, referred to as ‘Codefinger’ in the report, is reported to have attacked at least two victims, but the technique represents a worrying development as it requires no exploitation of vulnerabilities in the AWS platform.

Instead, if the threat actor is able to steal a customer’s account credentials they are able to use AWS’ secure encryption infrastructure to lockdown the victim’s data, with no known method of recovery without meeting their demands.

The attacker generates and stores AES-256 encryption keys locally, and Halcyon noted that because AWS does not store the encryption key it cannot help recover the data when victims report an attack.

AWS only logs a hash-based message authentication code (HMAC) of the key in its governance service, which the report states is insufficient for recovering any encrypted data, or for forensic analysis of the attack either.

Once they have encrypted the victim’s assets, the files are marked for deletion within seven days in order to coerce the victims into paying, warning them not to try to alter their account permissions and interfere with their access.

Hardening Amazon S3 to avoid compromise

The report noted that although Amazon’s server-side encryption feature has been around for some time, this looks like the first time ransomware operators have used it for malicious purposes, stating that it identified two victims who were impacted by the attack “in recent weeks”.

Halcyon said AWS users can mitigate the threat and harden their AWS environments by restricting SSE-C usage, monitoring and auditing their keys, and implementing advanced logging.

Customers should regularly review permissions for their AWS keys, Halcyon advised adding they should also disable unused keys and rotate active keys frequently.

ITPro approached AWS for a statement on the technique and a spokesperson for the firm said it protects customers to the best of its ability when their keys are exposed, pointing to its shared responsibility model for cloud assets.

“AWS helps customers secure their cloud resources through a shared responsibility model. Anytime AWS is aware of exposed keys, we notify the affected customers,” the spokesperson said.

“We also thoroughly investigate all reports of exposed keys and quickly take any necessary actions, such as applying quarantine policies to minimize risks for customers without disrupting their IT environment.”

The spokesperson added that all customers are strongly advised to act quickly if they believe their credentials may have been compromised.

“We encourage all customers to follow security, identity, and compliance best practices. In the event a customer suspects they may have exposed their credentials, they can start by following the steps listed in this post. As always, customers can contact AWS Support with any questions or concerns about the security of their account.”

Amazon Web Services (AWS) customers will soon be able to book time slots at physical locations to connect their storage devices and upload data to the cloud.

Data can be uploaded to any AWS endpoint, including Amazon S3, Amazon Elastic File System (Amazon EFS), or others, using a high throughput connection of up to up to 400Gbps.

Each AWS Data Transfer Terminal will house a patch panel, fiber optic cable and a PC for monitoring data transfer jobs, the hyperscaler revealed. Terminals will be charged by the hour, with no per GB charge for the data transfer if the data remains in the same continent.

The first two Data Transfer Terminals are already up and running in Los Angeles and New York, with plans to launch more globally.

So far, the company is only listing charges for US-to-US transfers - $300 per hour - and US-to-EU at $500.

"On your reserved date and time, visit the location and confirm access with the building reception. You’re escorted by building staff to the floor and your reserved room of the Data Transfer Terminal location," said Channy Yun, principal developer advocate for AWS Cloud.

"Don’t be surprised if there are no AWS signs in the building or room. This is for security reasons to keep your work location as secret as possible."

The company said the terminals will significantly cut the time it takes to upload large amounts of data, meaning ingested data can be processed within minutes.

Customers can then analyze large datasets using Amazon Athena, train and run machine learning models with ingested data using SageMaker, or build scalable applications using Amazon EC2.

"After the data is uploaded to AWS, you can use the extensive suite of AWS services to generate value from your data and accelerate innovation," Yun commented.

"You can also bring your AWS Snowball devices to the location for upload and retain the device for continued use and not rely on traditional shipping methods."

Suggested use cases include video production data for processing in the media and entertainment industry, training data for Advanced Driver Assistance Systems (ADAS) in the automotive industry, or migrating legacy data in the financial services industry.

The hyperscaler also noted the service could help support uploads of equipment sensor data in the industrial and agricultural sectors.

"You can upload large datasets from fleets of vehicles operating and collecting data in metro areas for training machine learning models, digital audio and video files from content creators for media processing workloads, and mapping or imagery data from local government organizations for geographic analysis," said Yun.

AWS has unveiled its new Amazon S3 Express One Zone storage offering, promising marked performance and speed improvements on its standard edition. 

CEO Adam Selipsky revealed the move during his keynote address at the annual AWS re:Invent conference in Las Vegas today alongside a slew of product updates which included the launch of its ‘Amazon Q’ generative AI assistant.

Selipsky told attendees that One Zone represents the next iteration of the popular cloud storage offering, which is 17 years old at this stage.

The new high-performance, low-latency storage class offers a 10x improvement on data access speeds in addition to a 50% lower request cost compared to Amazon S3 standard.

This equates to single-digit millisecond data access for customers.

The update comes amid a period of intense ML and AI-related workload demands from customers, the company said in a statement.

“Amazon S3 Express One Zone is the most performant storage class for request-intensive operations such as machine learning (ML) training and inference, interactive analytics, and media content creation,” the firm said in a statement.

Amazon S3 Express One Zone is tailor-made for AI 

Focusing heavily on supporting intensive AI workload capacities, AWS confirmed the launch of a new bucket type, dubbed an Amazon S3 directory bucket.

The cloud giant said customers will be able to create new directory buckets “with just a few clicks”, allowing them to upload new objects directly or copy objects from existing datasets in other S3 storage classes.

Traditionally, customers have been able to choose specific AWS Regions to store S3 data. However, the latest update also means users can now choose to co-locate One Zone data in the same availability zone as compute resources.

AWS said this will help “lower compute costs and run workloads faster”.

“Millions of customers rely on Amazon S3 for everything from low-cost archival storage to petabyte-scale data lakes, and they want to expand their use to support their most performance-intensive applications where every millisecond counts,” said James Kirschner, GM for Amazon S3 at AWS.

“Amazon S3 Express One Zone delivers the fastest data access speed for the most latency-sensitive applications and enables customers to make millions of requests per minute for their highly accessed datasets, while also reducing request and compute costs.”

The announcement marks the latest major update to Amazon S3 in recent years and underlines the continued longevity – and popularity – of the service.

In 2021, the tech giant added S3 Object Lambda, a service which enabled users to add their own proprietary code to process data retrieval from buckets before it is returned to an application.

2021 also saw the addition of the S3 Glacier Instant Retrieval function, also unveiled at its re:Invent conference.

The archive storage class offered low-cost storage for older datasets that are typically not accessed.

Amazon Web Services S3 buckets provide flexible, highly scalable, and cost-effective cloud-based, high-availability bulk data storage, suitable for everything from backups to big data, to hosting for media, files, and web apps.

S3 – short for Simple Storage Services – is popularly used for data storage, everything you upload is stored as a key-value pair with a unique name and the stored data as its value. This effectively means that it's a lightweight NoSQL database that can hold a vast amount of structured data, which can then be easily queried for analysis via S3 Select API calls. 

Critically, S3 doesn't care what the data you're storing is – you can stuff anything into an S3 bucket, with a maximum individual object size of 5TB and unlimited total storage, as long as you're prepared to pay for it.

Setting up and securing Amazon S3 storage

There are several different S3 storage classes. This guide primarily addresses S3 Standard storage, intended for "hot" data that's going to be regularly accessed. But it's worth being aware of your options, particularly if you anticipate eventually archiving your data to cold storage in Amazon's cloud.

These include S3 Intelligent-Tiering, which can potentially save money by automatically moving your least-accessed data to cheaper storage, Infrequent Access (IA) tiers that cost less than hot storage but still allow data to be accessed within milliseconds, and the Glacier tiers, which cost a lot less have increasingly slow retrieval times – up to 12 hours in the case of S3 Glacier Deep Archive storage.

While costing your deployment is beyond the scope of this article, we recommend using the AWS Pricing Calculator and billing alarms to help you avoid any unpleasant surprises. Amazon provides a helpful step-by-step deployment guide, but the density of the reference documentation for S3 means that it can be challenging to winnow out exactly which of S3's many options you need.

The convenience of setting up and using S3 storage, particularly if your data set is never intended to be made available to the public, can be deceptively simple. With both hackers and white hat cybersecurity professionals routinely scanning for unsecured S3 buckets using a variety of effective free tools, security through obscurity isn't going to cut it here.

Its default options have been beefed up in recent years, to minimize the danger of accidentally exposing the personal data of your staff, customers, or citizens, but it's still important to ensure that your S3 deployment is appropriately planned, configured, and secured for your use case.

In this guide, we'll take you through the key considerations you should apply to every S3 deployment, from planning to access and version control, through logging and multi-factor authentication.

Amazon S3 setup

Before setting up your S3 bucket, you should decide what it is – and isn't – going to be used for. Different use cases require different options and settings on the bucket, and some settings, such as S3 Object Lock, can only be set when the bucket is deployed, and cannot be changed later. This is also a good time to work out who or what will be accessing it, how they will be doing that, and from where. Document all of this for clarity, and to prevent function creep in the future. You don't want to find that people have been storing critical documents in your low-priority off-site backup store, or that access to these documents is too slow because you created the bucket in the wrong AWS region.

Local legal requirements should also be taken into consideration when choosing the AWS region in which your bucket will reside, such as EU requirements for data protection. If you're unsure about this, choose the AWS region in your country if there is one, or – if your country doesn't have its own AWS region – consult someone who knows the legal requirements and can advise on which regions are suitable.

Amazon S3 retention and deletion protection

Depending on the usage case for your bucket, you may wish to enable the S3 Object lock, or WORM (Write Once Read Many) mode. This means that once a file has been uploaded to the bucket, it cannot be deleted or modified in any way. This is useful in cases such as storing copies of quarterly backups, or accounting files needed for compliance. Files stored in buckets with this enabled will be preserved unchanged until the end of their retention period. 

Alternatively, you may wish to enable versioning for objects in this bucket, if it is to be used to store critical files, or disable it, for example, if this is a backup store, as the backup software should take care of that. 

Lifecycle settings

Once you've created your bucket, you'll want to set some lifecycle rules to keep it in check. Rules can be set up to move files to less expensive storage classes after a specified period of time, delete older versions of files in buckets with versioning enabled, and perform basic housekeeping tasks. At the very least, you would probably want a set of rules to move objects from primary instant-availability storage to a lower cost tier such as Glacier after a time, and then eventually purge outdated files, so as to keep costs down.

S3 Default Encryption

Since January 2023, S3 has automatically encrypted all new objects uploaded to it using AES-256 hashing with server-side S3-managed (SSE-S3) keys, at no additional cost to users. This default option now has to be deliberately opted out of if you require an alternative approach, while it was previously an opt-in setting, which contributed to unnecessarily poor security on some users' buckets.

Note that objects in a bucket predating the new default, which had not previously been opted into S3 default encryption, can be manually encrypted to the same standard using a batch operation.

While SSE-S3 encryption is the default standard, you can also enable SSE-KMS, another approach to server-size encryption which uses the AWS Key Management Service. A dual-layer version, DSSE-KMS is also available, and customers can alternatively deploy their own keys using SSE-C, server-side encryption with customer-provided keys. While different objects in your bucket can use different encryption methods, you can't apply multiple types of encryption to a single object.

Access management

To control access to your new bucket for either people or processes, you will need access keys. Whilst you can generate these as your AWS admin user, you very much should not do so. It's better for your security if you create a dedicated user in IAM (AWS Identity and Access Management) for each process or person requiring access, granting them the minimum rights required, for example read-only, read-write, or full S3 access. Security keys can then be created for these users from their IAM details page.

Version control

For those who require more granular access control, access policies can be used. These are written in JSON, and if you wish you can input that directly. However, for the majority of users who'd prefer not to do that, there is a policy generator. Set the policy type to S3 Bucket policy then configure the required access conditions. Example policies are also available at this stage to assist with this process.

If your bucket is to be used for storing regularly accessed files, rather than as a backup or archive of some form, you may wish to enable versioning. This will allow you to revert any object stored in the bucket to any previous version, limited only by the retention policies set in your lifecycle rules for this bucket. Lifecycle policies can be used to move older versions to cheaper storage tiers or delete them completely after a given time. Care should be taken when setting these rules to balance the utility of being able to revert files to previous versions against the increased storage costs this incurs. 

Replication

If the objects to be stored in your bucket are critical, then you may wish to enable replication. This feature automatically – but asynchronously – copies objects from one S3 bucket to another, usually within 15 minutes of the initial object's creation. This ensures that there's never a single point of failure for your most critical data.

You can configure replication rules to replicate certain classes of objects in the bucket, or its entire contents. The replication target will be another S3 bucket, either in the same region as the original or in a different region. Note that data transfer charges will apply to data moving between regions, so bear this in mind when deciding on your replication setup. Likewise, the target bucket will also need its own lifecycle policy.

Logging, monitoring and auditing

If required, you can enable either basic access logging, event auditing, or both for your bucket. This will allow you to keep track of who accessed what data and when, and make it easier to spot any unauthorized access to these objects. It's thus highly recommended.

AWS's monitoring tools for S3 include alarms that will alert you if any selected metric (such as storage in use) passes a specified threshold, detailed user activity and server access logs, and "AWS Trusted Advisor", an automatic inspection and recommendation tool that will inspect and make security and configuration recommendations for your S3 bucket.

Security

There are two forms of access used in most cases with S3 buckets. Interactive user access and programmatic key-based access. For interactive users, multi-factor authentication (MFA) should always be enabled, and the users' rights should be limited to the minimum required. You should not be using your AWS admin account when accessing the bucket contents, but rather a lower privileged account setup for the purpose.

For programmatic key-based access, such as your backup software storing its nightly backups in the S3 bucket, the access keys should be rotated periodically. This helps to avoid any unauthorized access incidents resulting from keys that may have leaked. It also familiarises you, as the admin, with AWS's key rotation procedure, which is important as this will need to be done promptly as and when staff leave the organization, or in response to security incidents.

For those developing software that uses an S3 bucket as storage, be especially careful not to commit the access keys to any public (or even internal) code repository. There have been many security incidents reported by the press caused by someone carelessly committing an access key to Github or similar.

Common S3 code errors

When it comes to configuration, the AWS Share Responsibility Model warns users that they are responsible for security 'in' the cloud. AWS takes care of security out of the cloud, so the user is liable for the changes they make that publicly expose their own data. Thankfully, the most common misconfigurations are avoidable.

Arguably the most common S3 error code is the 403 'AccessDenied' code. This is usually a case of bucket and object ownership. If the error is from 'GetObject' or 'HeadObject' requests, you should check whether the object is also owned by the bucket's owner – if you are the bucket owner, then you should check the access control list (ACL) permissions. An S3 object is, by default, owned by the AWS account that uploaded it. If other accounts have permission to upload to your bucket, then you would need to verify the account that owns that object – also verify who can access it.

Another common error is "MultiRegionAccessPointModifiedByAnotherRequest" or error code '200'. These can crop up for a range of reasons but they are all to do with regional access points. So, for example, an action failed because another request is modifying a specific resource. Or you have a multi-region access point with the same name. 

For a complete list of error codes, see the AWS Error Response page here.

S3 pricing

You can start using S3 for free, though you will be charged for what you use. Essentially you don't pay to have a bucket, but you do pay for putting stuff in said bucket and the amount you pay is dependent on the size of the objects you store and how long you store them. You will also be charged on the tier of S3 service you use – Standard, Intelligent-Tiering, Standard-Infrequent Access, S3 One Zone-Infrequesnt Access, Glacier Instant Retrieval, Flexible Retrieval, and Glaxer Deep Archive.

AWS provides an online calculator to work out your fees. You need to consider ingest and transfer costs first, but you simply estimate your region, your storage needs, and your preferred tiering. So, for example, if you were to set up S3 with California (US West Coast) as the region and wanted 10TB stored per month in S3 Standard, the monthly fee would be $267. 

Amazon S3 is the company's premier object storage service, and one of the first products it brought to market. It remains one of the most popular storage services available today, working in tandem with, and underpinning, most of Amazon's other customer-facing services.

Amazon S3 is regularly updated with new features and storage capabilities, and patches that are designed to improve data protection and security.

What is Amazon S3?

Amazon Simple Storage – or Amazon S3 as it is more commonly known – is an object storage service. It offers unlimited, flexible cloud storage for seemingly any use case, whether that’s big data analysis, cloud-native applications, or mobile apps.

Object storage, or ‘object-based’ storage, is a type of architecture that manages data as an object, instead of files or blocks. Each object includes the data itself, a variable of metadata, and a globally unique identifier. The metadata element is key, as it is separated to support additional capabilities, such as the capture of application-centric or user-centric information for indexing, which is traditionally harder with fixed metadata.

Amazon S3's object storage approach is designed in a way that simplifies data admin. It removes the need for many basic storage functions, such as construction and management of logical volumes for disk capacity, or configuring settings to prevent disk failure.

Part of the reason Amazon S3 is so popular is its accessible pricing. Customers only pay for what they use, and there is no minimum service fee. It's also quite cheap, with the first 50TB, or the first month of use, being just $0.024 per GB – price accurate at the time of writing.

Amazon S3 security: What are buckets and keys?

Amazon S3 organises data into 'buckets'. These act as data repositories that can handle an unlimited number of objects, although each object is limited to a maximum size of 5TB. Buckets are designed in a way that allows for data to be organized and for access controls to be placed on objects.

 Any object placed inside a bucket will be assigned a unique key, which helps locate and identify specific data objects within each bucket. This key resembles the structure of a URL, and is made up of the bucket number, the object number, and the region or data center the data is stored in.

Buckets must be appropriately configured in order to prevent unauthorized access to data. Historically, Amazon S3 buckets have been the source of a number of high-profile data leaks, including those belonging to the NSA, largely due to misconfigurations through human error.

Amazon has made efforts to minimize cyber security risk with constant updates and new features, and now includes a wealth of security controls for use across a variety of businesses.

For example, following an integration deal with CloudKnox in 2019, the company introduced a built-in identity and access management (IAM) tool to make it easier to monitor access controls.

Admins can also make use of the 'S3 Block Public Access' function, which is able to prevent access to specific buckets from those outside of a company or approved list. This function also overrides any existing blanket S3 permissions.

Read our guide to setting up and securing Amazon S3 for more information.

Amazon S3 latest features and updates

As a flagship product, Amazon S3 often receives new updates and innovations at the tech giant’s annual conferences. These can sometimes be tie-ins with other AWS services but it mainly sees new cost efficiencies and user improvements.

For instance, in 2021, Amazon added S3 Object Lambda, a service that allows users to add their own code to process data retrieval from their S3 buckets before it is returned to an application. The introduction of Lambda enables users multiple views of the same dataset, with capabilities to change the views at any time.

Another new function is S3 Glacier Instant Retrieval, which was launched during 2021’s AWS Re:Invent. This is a new archive storage class which offers low-cost storage for older datasets that are rarely accessed. AWS claims it is the fastest access to archive storage and offers 63% cost savings compared to previous services.

Audio equipment manufacturer Sennheiser exposed personal data belonging to around 28,000 customers through a misconfigured Amazon Web Services S3 bucket, researchers revealed on Thursday.

The data in question had been collected between 2015 and 2018 and then stored on a public-facing S3 bucket that has remained dormant ever since, according to experts at VPN reviews website vpnMentor.

The data included customers' full names, email addresses, phone numbers, and home addresses, as well as the names of companies requesting hardware samples and the number of employees they had. At least 407,000 files, totaling 55Gb of data, were available.

"Sennheiser failed to implement any security measures on its S3 bucket, leaving the contents totally exposed and easily accessible to anyone with a web browser and technical skills," the researchers said.

The researchers discovered the exposed data on October 26, notifying Sennheiser two days later. Following a request for more information on November 1, the researchers sent the company the URL leading to the unsecured server along with examples of the types of information they had been able to lift. The company then locked the server down a few hours later.

VpnMentor said that if anyone had accessed the exposed data, they could have used it for identity theft, enabling them to perpetrate tax, insurance, mortgage, and credit card fraud. They could also have sent phishing emails to victims impersonating Sennheiser in order to source an even greater trove of personal information.

S3 is the storage layer supporting AWS services, and can be configured to be accessible from the public internet or to be private. However, it remains up to customers to make sure the buckets are configured correctly.

Exposing data in misconfigured S3 buckets is a common problem for AWS customers. In August, consumer ratings and review website SeniorAdvisor exposed over three million US senior's personal data via the cloud-based service. In June 2020, vpnMentor also discovered sensitive files from at least 100,000 users across multiple dating sites in exposed S3 storage.

Amazon has attempted to mitigate the problem, which typically stems from human error, with a tool to spot misconfigured resources.

Internet giant Cloudflare has made a bold pitch for enterprise customers with its new R2 object storage service.

Cloudflare claims the selling point of R2 is that it comes with no "outrageous" charges for migrating data to external services, pitting it directly against Amazon's dominant S3 service.

R2 Storage is designed for the edge, according to Cloudflare, and offers customers the ability to store large amounts of data and extract it for no additional cost.

In order to build websites and applications, developers need to store photos, videos, and graphics in easily accessible places, but that can become an expensive problem over time. AWS S3 is well known for its "egress" charges that can result in hefty bills over time, and Microsoft Azure and Google Cloud also implement similar fees for data migration.

However, both Azure and Google Cloud offer substantial discounts for their mutual Cloudflare customers, according to a Cloudflare blog from July.

"We agree that Amazon S3 has been a game changer for developers. With the deepest feature set and industry-leading scalability, data availability, security, and performance, customers are storing well over 100 trillion objects there today. While we can't comment on a product that has been announced but not released, we welcome competition generally across our businesses because we believe it is healthy and helps grow markets," an AWS spokesperson said.

Increasingly egregious bandwidth pricing has made cloud storage an expensive headache for some developers, and eventually leads to vendor lock-in, according to Cloudflare. As such, the company is making it its mission to heIp build a better internet by focusing on making it faster, safer, and also more affordable for everyone.

"Since AWS launched S3, cloud storage has attracted, and then locked in, developers with exorbitant egress fees," said Matthew Prince, co-founder and CEO of Cloudflare. "We want developers to keep developing, not worrying about their storage bill.

"Our aim is to make R2 Storage the least expensive, most reliable option for storing data, with no egress charges. I'm constantly amazed by what developers are building on our platform, and look forward to continued innovation as we expand the tools they have access to."

As well as entering the enterprise storage business, Cloudflare this week also announced its first foray into the email security industry.

UK Printing company Doxzoo inadvertently exposed 343GB of data through a misconfigured Amazon Web Services (AWS) S3 bucket, including sensitive information said to relate to branches of the UK and US military.

Potentially more than 100,000 users were affected by the data leak, with approximately 270,000 records exposed including personal information and payment information, as well as order details, passport information, and the contents of printing orders.

Among the exposed data was the copyrighted and sensitive work of Doxzoo clients, who spanned from military personnel to screenwriters. Researchers with vpnMentor, led by Noam Rotem and Ran Locar, found a wide range of information including university course material, screenplays, and internal military documents, some of which contained classified information.

“The items contained this leak often hold private and/or confidential information within,” said vpnMentor’s research team.

“The promise of secure facilities and systems are key selling points for clients such as the military, and the breach of that guarantee is not only a failure in service, but also potentially holds a security risk along with it.”

The security firm has been finding pockets of exposed information for many months as part of a wider web-mapping project, and have recently detailed finding several alarming troves of exposed data.

These findings include a database of 604GB of text messages run by US-based communications firm TrueDialog, as well as sensitive information from British consultancy firms and consultants such as passport scans and financial documents.

The firm previously discovered exposed US military data in October 2019 due to a flaw in a reservations management system owned by the Best Western hotel chain. Personnel working for the US Department for Homeland Security (DHS) and the military was seen by researchers from vpnMentor, including travel arrangements both past and future.

The countries affected include not just the US and the UK, but clients in Sri Lanka, Nigeria and India, according to researchers. The UK-based printing company has a number of high profile clients and projects, including full-length books and sought-after paid wellness plans.

Doxzoo could have avoided this leak if they had taken basic security measures to protect the S3 bucket, vpnMentor said, including securing their servers, implementing proper access rules, and preventing system that don't need authentication from being accessed by the public through the internet.

The firm first discovered the exposed database on 22 January, before notifying the company four days later. Because Doxzoo didn’t respond to vpnMentor’s communication attempts, Amazon was notified on 5 February, and the bucket was finally closed on 11 February.

Leaky servers exposed a wealth of personal and financial data held by British consultancy firms as well as thousands of professionals, ranging from expenses forms to personal names and addresses.

Thousands of sensitive files stored on an Amazon Web Services (AWS) S3 bucket had been exposed for an indeterminate amount of time after a database was found to be completely unsecured and unencrypted.

The compromised files related to the respective HR departments of a host of consultancy firms, as well as thousands of workers whose data was held by these departments.

Most of the exposed data dates back to the 2014/15 financial year, with some files even going back to 2011, although researchers with vpnMentor, who discovered the leaky database, insist the information exposed is still pertinent to cyber criminals.

“Given the nature of the files contained within the database, the information exposed is still relevant and could be used in many ways,” the researchers said.

“Had criminal hackers discovered this database, it would have been a goldmine for illicit activities and fraud, with potentially devastating results for those exposed.”

The open S3 bucket was discovered on 9 December 2019 and shut down ten days later after AWS responded to the researchers.

The documents include thousands of passport scans, for instance, tax documents, background checks, paperwork relating to business taxes, scanned contracts with signatures, as well as emails and private messages.

This is on top of a treasure trove of personally identifiable information such as full names, addresses, phone numbers, and email addresses, as well as immigration statuses, salary details and details of individual consultants’ fees.

Having identified the database owner as just ‘CHS’, the researchers traced this back to CHS Consulting, a London-based consultancy firm. However, the researchers couldn’t completely verify the ownership of the database because this company has no website.

The companies whose files were exposed include, but are not limited to, Dynamic Partners, Eximius Consultants Limited, Garraway Consultants, IQ Consulting, Partners Associates Ltd, Winchester Ltd, researchers with vpnMentor have claimed. A handful of these firms have been dissolved.

vpnMentor discovered the leak as part of a wider web-mapping project, in which port scanning is used to examine IP addresses and test open holes in systems for any potential weaknesses.

“Our team was able to access this AWS S3 bucket database because it was completely unsecured and unencrypted,” the researchers added. “The purpose of this web mapping project is to help make the internet safer for all users.

“As ethical hackers, we’re obliged to inform a company when we discover flaws in their online security.

“As we couldn’t reach out to the owner directly, we reached out to both the NCSC and Amazon, to let them know about the vulnerability but also to have them help us secure the data.”

The exposure of thousands of consultancy-related files is one of the first major data incidents of 2020, although it follows several similar leaks late last year.

The same team of researchers, for example, in December 2019 found a trove of millions of text messages leaked through an exposed Microsoft Azure server owned by the US-based communications firm TrueDialog.

Highly sensitive data belonging to the US Department for Homeland Security (DHS) and the US military to the tune 179GB was also leaked through an unsecured AWS S3 bucket, discovered in September and closed on 2 October 2019.

Research into the breach of Capital One's systems this week has suggested that a number of other major organisations could have also been hit by the same hacker.

Israeli firm CyberInt revealed that Vodafone, Ford, Michigan State University and the Ohio Department of Transportation were also mentioned alongside Capital One in communications sent by alleged hacker Paige Thompson, according to Fox Business.

The former Amazon employee, going by the online alias 'erratic', is believed to have hacked into Capital One's systems that contained details belonging to over 100 million customers in the US and Canada.

"I wanna get it off my server that's why I'm archiving all of it lol... it's all encrypted," Thompson is quoted as saying in the communications.

One other member of the channel replied: "sketchy sh*t... don't go to jail plz".

TechCrunch contacted each of the affected companies, all of which were still investigating the matter but had no evidence that files had been accessed or stolen.

Thompson is said to have disclosed her exploits to members of a public Slack channel, along with a list of targetted companies. She is also said to have posted proof on a GitHub page that was linked to her identity, in addition to a number of Twitter posts.

"Had the perpetrator followed a responsible disclosure process, such as the one published by Capital One and used to report the location of the breached files, then she might not be facing these criminal charges and we as consumers might have avoided yet another instance of our personal data becoming available for public consumption," said Tim Mackey, principal security strategist, Synopsys Cybersecurity Research Center, speaking to IT Pro.

The data breach, which affected 106 million individuals in North America, is arguably 2019's most significant one yet and one that could develop further as the other affected companies conclude their internal investigations.

30/07/2019: Capital One suffers data breach affecting 100m customers

Capital One bank suffered a data breach on Monday which affected over 100 million customers in the US and Canada.

The bank was hacked via a misconfigured web application and the suspect is believed to be a 33-year-old former Amazon software engineer named Paige Thompson.

According to current estimates, 140,000 social security numbers had been leaked in the breach, along with 80,000 linked bank account numbers. Phone numbers and credit scores were also leaked but the hacker failed to access credit card numbers.

Around six million Canadian customers were affected in the breach, around one million of which saw their social insurance numbers compromised.

"While I am grateful that the perpetrator has been caught, I am deeply sorry for what has happened," said Richard D. Fairbank, Chairman and CEO at Capital One. "I sincerely apologize for the understandable worry this incident must be causing those affected and I am committed to making it right."

According to a complaint filed in the District Court for the Western District of Washington at Seattle, Thompson posted details of the hack on her GitHub page which was linked to her real name before a user saw the files and notified the bank.

Capital One said it acknowledged the hack on 19 July and its believed the hack lasted for longer than five months between 12 March and 17 July.

"According to the available reports about this breach, it appears that the vector of exploitation was a misconfigured data bucket accessible over the internet from a public IP address," said Alexander Heid, chief research officer at SecurityScorecard.

"An unauthorized hacker had siphoned out information from the buckets using system commands that would normally have been blocked, and posted the results to various outlets - such as code repositories, chat rooms, and social networks," he added.

Capital One is a major bank and provider of credit cards in the US and Canada and it also has a presence in the UK as a credit card issuer.

Last week, credit reporting agency Equifax was fined $700 million for its catastrophic 2017 data breach which saw around 147 million customers affected, 15 million of which were British. Information that was leaked during the attack included social security numbers, driver's license details, email addresses, phone numbers and partial credit card information.

"Compared to Equifax, this breach does not appear to have had anywhere near the same amount of impact," said Heid. "While there were hundreds of millions of records leaked, only a small percentage of those records contained social security information or banking information and there is no indication at this time that the data was distributed beyond the identified individuals.

More than 17,000 domains have been compromised in an attack launched by the prolific hacking group Magecart, according to attack surface management firm RiskIQ.

The attack preys upon websites with leaky Amazon S3 buckets, an attack method seen all too often despite them now being protected by default. The researchers said that anyone with an AWS account could read or write files in the affected buckets.

The attackers scanned the web for misconfigured buckets to see if they had any Javascript files they could download and add their skimming code, overwriting the script on the bucket.

Magecart was trying to run scripts on websites to glean and make off with payment information that can then be sold on for profit. It wasn't just smaller websites affected by the attack, some of the 17,000+ compromised websites fell into the top 2,000 Alex rankings.

The problem with the attacker's methodology is this type of skimming attacks rarely works on payment pages of websites, which makes the chance of a successful attack low compared to a more considered, targeted approach.

But the Magecart group could still enjoy "a substantial return on investment" due to the range of the attack. "The ease of compromise that comes from finding public S3 buckets means that even if only a fraction of their skimmer injections returns payment data, it will be worth it," said Yonathan Klijnsma, threat researcher at RiskIQ, in a blog post.

"Perhaps most importantly, the widespread nature of this attack illustrates just how easy it is to compromise a vast quantity of websites at once with scripts stored in misconfigured S3 buckets," he added. "Without greater awareness and an increased effort to implement the security controls needed to protect the content stored in these buckets from theft or alteration by malicious attackers, there will be more and more impactful attacks using techniques similar to the ones outlined in this blog."

Exploiting misconfigured Amazon S3 buckets is a common attack method used time and again by opportunistic cyber criminals.

Earlier in the year, Facebook apps Cultura Collectiva and At the Pool became victims of a similar attack, with the cyber criminals making off with 540 million records, including users' names, IDs and comments made through Facebook's social integration.

"Like any other security procedure, security policies are a good mechanism for protecting the access to your S3 Bucket, but it needs to be used the right way," said Boris Cipot, senior security engineer at Synopsys. "It has to be understood, and the user needs to know what they are doing when applying those policies to their buckets.

"Unfortunately, misconfigured policies then can lead to examples like those where the attacker can identify buckets with those misconfigured policies and modify the content on them," he added. "Every user should have a good understanding of what they're doing, but if this is not possible, leave it to professionals that know how to handle security.

"On the other hand it would be nice to see if Amazon could make a policy screening functionality were they could identify such misconfigured policies and warn the user or in some cases even forbid the usage of loose policies."

Other notable examples of devastating attacks made possible by leaky buckets include the leak of data belonging 120 American households by Experian. The NSA, WWE and Accenture also suffered similar attacks.

The future looks bright, however. According to reports, since Amazon enabled encryption for buckets by default, the number of exposed files has plummeted to less than 2,000 whereas the number was in the region of 16 million beforehand.

AWS has said that its Textract tool, designed to extract and translate data between files, is now generally available for all customers.

The tool, which is a machine learning-driven feature of its cloud platform, lets customers autonomously extract data from documents and accurately convert it into a usable format, such as exporting contractual data into database forms.

The fully-managed tool requires no machine learning knowledge to use and works in virtually any document. Industries that work with specific file types such as financial services, insurance and healthcare will also be able to plug these into the tool.

Textract aims to expedite the laborious data entry process that is also often inaccurate when using other third-party software. Amazon claims it can accurately analyse millions of documents in "just a few hours".

"Many companies extract text and data from files such as contracts, expense reports, mortgage guarantees, fund prospectuses, tax documents, hospital claims, and patient forms through manual data entry or simple OCR software," the company said.

"This is a time-consuming and often inaccurate process that produces an output requiring extensive post-processing before it can be put in a format that is usable by other applications," it added.

Textract takes data from scanned files stored in Amazon S3 buckets, reads them and returns data in JSON text annotated with the page number, section, form labels, and data types.

PwC is already using the tool for its pharmaceutical clients, an industry that commonly uses processes that involve Food and Drug Administration (FDA) forms that would otherwise require hours to complete, according to Siddhartha Bhattacharya, director lead, healthcare AI at PwC.

"Previously, people would manually review, edit, and process these forms, each one taking hours," he said. "Amazon Textract has proven to be the most efficient and accurate OCR solution available for these forms, extracting all of the relevant information for review and processing, and reducing time spent from hours to down to minutes."

The Met Office is another organisation that plans to implement Textract, making use of old weather records.

"We hope to use AmazonTextract to digitise millions of historical weather observations from document archives," said Philip Brohan, climate scientist at the Met Office. "Making these observations available to science will improve our understanding of climate variability and change."

Facebook's heavily criticised app integration system has led to more than 146GB worth of data being left publicly exposed on AWS servers owned and operated by third-party companies.

It's believed 540 million records relating to Facebook accounts were stored on the servers, including comments, likes, reactions, names and user IDs, obtained when users engaged with applications on the platform - the same methods unearthed during the investigation into Cambridge Analytica.

Two apps have been associated with the data hoard so far: Cultura Colectiva, a Mexico-based media company that promotes content to users in Latin America, and At the Pool', a service that matched users with other content, which has been out of operation since 2016.

At the Pool is said to have held 22,000 passwords for its service in plaintext alongside columns relating to Facebook user IDs - the fear being that many users may have been using the same password for their Facebook accounts.

Both of the app's datasets were stored in Amazon S3 buckets which were found to be misconfigured to allow public download of the files. Despite being commonly used among businesses, as they allow data to be distributed across servers in a wide geographical area, there have been multiple incidents involving companies failing to adequately safeguard their data.

Facebooked condemned the practices of both the apps. "Facebook's policies prohibit storing Facebook information in a public database," said a Facebook spokesperson. "Once alerted to the issue, we worked with Amazon to take down the databases. We are committed to working with the developers on our platform to protect people's data."

AWS was made aware of the exposed data on 28 January 2019, following an alert issued by security research firm UpGuard. AWS confirmed it had received the report and was investigating it, but the data was only secured on Wednesday this week.

"AWS customers own and fully control their data," an AWS spokesperson told IT Pro. "When we receive an abuse report concerning content that is not clearly illegal or otherwise prohibited, we notify the customer in question and ask that they take appropriate action, which is what happened here."

This statement aligns with UpGuard's in that the researchers alerted Cultura Colectiva before AWS on 10 January 2019 but have still yet to receive a response from the company.

Accenture, Experian, WWE, and the NSA have all been found to have stored data on unsecured AWS servers in recent years, with the problem becoming so prevalent that hackers have started creating tools specifically designed to target these buckets.

"While Amazon S3 is secure by default, we offer the flexibility to change our default configurations to suit the many use cases in which broader access is required, such as building a website or hosting publicly downloadable content," said AWS. "As is the case on-premises or anywhere else, application builders must ensure that changes they make to access configurations are protecting access as intended."

The news coincides with an article published in The Washington Post in which Facebook's Mark Zuckerberg called for a worldwide GDPR' and greater regulation on the data protection principles of big tech outside the EU, despite the company itself facing 10 major GDPR investigations.

The discovery of the data has once again raised the issue of Facebook's data sharing policies, something that facilitated the improper sharing of user data for political purposes by Cambridge Analytica. This prompted Facebook to change its sharing policies to restrict access by third-parties, although the fear is that data troves such as this have already been widely shared.

"Cambridge Analytica was the most high profile case that led to some significant changes in how Facebook interacts with third-party developers, but I suspect there are many troves of Facebook data sitting around where they shouldn't be, including this one," said privacy advocate Paul Bischoff of Comparitech.com.

"Even though Facebook has limited what information third-party developers can access, there's still nothing Facebook can do about abuse or mishandling until after the fact," he said.

More than 1.5 billion sensitive corporate and consumer files, including payroll details and intellectual property data, are publicly exposed, according to cybersecurity company Digital Shadows.

Researchers at the firm detected files amounting to 12,000 terabytes of data hosted across Amazon Web Services (AWS) S3 buckets, rsync sites, server message block (SMB) and file transfer protocol (FTP) servers, Misconfigured Websites (WebIndex), and web-connected NAS drives as publicly accessible over the first three months of 2018, detailing their findings in a report titled Too Much Information.

For scale, the volume of data is roughly 4,000 times the size of 2016's Panama Papers leak.

The files are mostly stored in storage drives or buckets that are unencrypted and open to the public, meaning anyone with the correct URL address could access these documents, despite many containing people's personal information, something the EU's GDPR data protection legislation will be able to punish with huge potential fines when the rules come into force next month.

Digital Shadows CISO Rick Holland said: "The volume of this sensitive data exposure should be a major cause for concern for any security and privacy conscious organisation. In addition, with GDPR fast-approaching, there are clear regulatory implications for any organisation with EU citizen data."

Following numerous high profile breaches from companies mistakenly storing private information in public S3 buckets, AWS introduced the option to enable default encryption for its cloud storage last November. But as recently as February, FedEx locked down an unsecure S3 server following the exposure of data belonging to more than 119,000 citizens from around the world. And Digital Shadows found S3 buckets still accounted for 6.5% of the exposed data it discovered this year.

But at 33%, most of the exposed files were found on unencrypted SMB servers; followed by those stored on file-sync rsync sites (28%) and transferred using FTP servers (26%). Payroll (707,960) and tax return (64,048) files were the most commonly exposed employee data.

Moreover, Digital Shadows found a significant portion of intellectual property data at risk, with the cybersecurity company discovering, for example, a patent summary for renewable energy in a document marked "strictly confidential".

On another instance a document containing proprietary source code submitted as part of a copyright application was found; including code outlining the design and workflow of a site providing software Electronic Medical Records (EMR), as well as details of the application.

Confidential information on members of the public also appeared, with 14,687 files listing people's contact information and 4,548 documents identifying healthcare patients, as well as files including transactional information, and some credit card data exposed.

"While we often hyper-focus on responding to adversaries conducting intrusions into our environments and silently exfiltrating our data, we aren't focusing on our external digital footprints and the data that is already publicly available via misconfigured servers," Holland said.

US firms had the highest number of leaked files, accounting for more than 239 million (16.3%), while the European Union as a whole made up more than 537 million files (36.5%). More than 64 million files were found to be exposed in the UK, while Germany and France together amassed more than 238 million exposed files.

Digital Shadows urged organisations to increase user training and awareness to combat the issue in the long term, but the report also mentioned tips to ensure organisations mitigate their risk to inadvertent exposure.

For users of FTP and SMB servers and rsync sites, Digital Shadows recommended the use of a password, and disabling guest or anonymous access, while firewalling the port off from the internet, and whitelisting the IPs permitted to access the resource.

Although S3 buckets can be encrypted by default, Digital Shadows recommends AWS users understand how to do so, while Misconfigured Websites (WebIndex) users are advised to disable directory listings unless required, and NAS drive users can add a password and disable guest or anonymous access, as well as opt for NAS devices that are secured by default.

Picture credit: Bigstock

The NSA has been hit by yet another data leak, as over 100GB of sensitive, classified data was exposed through shoddy security practises.

The leak came from a virtual copy of a hard drive belonging to US Intelligence and Security Command (INSCOM), an intelligence organisation operating within both the US Army and the NSA.

The virtual disk image was discovered by UpGuard cyber risk research director Chris Vickery on an unprotected public Amazon S3 server, meaning that anyone who knew the web address where the data was stored could freely access it.

Unsecured S3 buckets are a frequent cause of embarrassing data breaches for many companies and government organisations. The personal details of two million Dow Jones customers were exposed in a similar fashion earlier this year, as were customers of Accenture and the WWE.

"Regrettably, this cloud leak was entirely avoidable," UpGuard said in a blog post announcing the discovery, "the likely result of process errors within an IT environment that lacked the procedures needed to ensure something as impactful as a data repository containing classified information not be left publicly accessible."

"Plainly put, the digital tools needed to potentially access the networks relied upon by multiple Pentagon intelligence agencies to disseminate information should not be something available to anybody entering a URL into a web browser," the post said. "Although the UpGuard Cyber Risk Team has found and helped to secure multiple data exposures involving sensitive defense intelligence data, this is the first time that clearly classified information has been among the exposed data."

The drive in question contained a trove of data related to a US military project codenamed 'Red Disk', a failed cloud collaboration and content sharing platform designed to let field troops access real-time intelligence data from the Pentagon, including satellite and drone imagery.

The drive also included hashed passwords for internal systems, as well as private keys belonging to third-party INSCOM defence contractors for accessing "distributed intelligence systems". Multiple areas of the drive were marked 'Top Secret', with some sections even bearing the 'NOFORN' designation, indicating that they were to be kept secret even from the US government's foreign intelligence allies.

IT Pro has reached out to the NSA to ask why the appropriate protections were not taken, and will update this piece when we hear back.