how it happened
- whoAI researchersshared training data
- the gapSAS tokenfull control of the whole account
- the result38TB exposedbackups, keys, messages
what everyone assumed
A share link feels precise, a pointer to the specific thing you meant to share. The assumption is that the link carries exactly what is in front of you, nothing more, because that is what sharing a file feels like.
what happened
The token was scoped to the entire storage account with full-control permissions, not the one read-only folder intended. For roughly three years it exposed far more than training data: workstation disk backups, secrets, private keys, passwords, and tens of thousands of internal messages.
step by step
- a share link is meant for one read-only folderTo publish open-source training data.
- the token covers the whole storage account with full controlFor roughly three years.the assumption breaks here
- far more than training data is reachableWorkstation backups, secrets, keys, internal messages.
- September 2023researchers report 38 terabytes exposedThrough one overly broad link.
how it surfaced
In September 2023 external researchers found the misconfigured token and reported 38 terabytes of private data exposed, including two employees’ full workstation backups, through a single overly broad share link.
A share link inherits the permissions of the scope it was cut from, not the file you were looking at.
Broad by default plus convenient to create is how one intended share becomes thousands of unintended ones.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersThe link sits in public view for years.what it costs youFar more than the intended files is exposed, including private backups.
- or it goes like thisit happenedPower Apps misconfiguration, 2021howA default on a no-code app leaves its data readable without logging in.what leavespersonal records you collectedwho ends up with itanyone who looks
- or it goes like thisit happenedToyota cloud exposure, 2023howA wrong setting is never rechecked and stays open for years.what leavescustomer data, over a long stretch nobody can account forwho ends up with itnobody knows, which is the problem
sources
your turn
what you can do about it
this week
Pull the report of your widest file shares and links.
Your file platforms make broad links easy and precise scoping a deliberate extra step, which is why anyone-with-the-link shares accumulate. One of them probably reaches more than its creator believed. The report of your widest shares is the Microsoft lesson made checkable in an afternoon.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →