Ransomnews research identifies 18 billion files in exposed cloud buckets

A new report from the Ransomnews research team, titled the Ransomnews Cloud Exposure Index, has identified 484,142 publicly listable cloud storage buckets containing approximately 18.05 billion files. The study, conducted in October 2026, utilized search engines that index open cloud storage to analyze bucket names, file extensions, file counts, and timestamps without opening individual files.

The research found that the exposed data includes credentials, database dumps, and backups. Specifically, researchers identified 321,058 files related to credentials and keys. While many buckets are public by design to host website assets or open datasets, the index highlights significant concentrations of sensitive material.

Amazon S3 accounts for 71.9% of the exposed buckets, which researchers noted is consistent with its market share. Azure Blob represents 14.2% of the total, though it appeared 2.5 to 3.6 times more frequently than expected in buckets labeled for backups, payroll records, and data exports. Other providers identified include Google Cloud Storage, DigitalOcean Spaces, and Alibaba OSS.