how it happened
- whoanyone onlineno login
- the gapdefault settingpublic unless locked
- the result38M records47 organisations
what everyone assumed
A default from a major vendor feels like a recommendation, a safe baseline chosen by people who know better. The assumption is that out-of-the-box settings protect you until you deliberately open them.
what happened
Where administrators had not explicitly locked permissions and had enabled a data feed, anonymous users could read the underlying records straight through the interface. Many organizations never changed the setting, because it looked like it was already safe, and the vendor initially described the behavior as intended.
step by step
- a data feed is enabled with default permissionsIt looks like it is already safe.the assumption breaks here
- anonymous users can read the recordsStraight through the interface.
- 202138 million records exposed across 47 organisationsContact tracing data, Social Security numbers, employee IDs.
how it surfaced
In 2021 researchers found 38 million records exposed across 47 organizations through this default, including contact-tracing data, Social Security numbers, and employee IDs, across government and major companies.
A default is a decision the vendor made for you, and it is not always the safe one.
Out of the box can mean open, and assuming otherwise is how millions of records sit exposed in plain configuration.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersA researcher finds the data open to the internet.what it costs youPersonal details you collected are exposed through a setting you never knew existed.
- or it goes like thisit happenedMicrosoft AI data exposure, 2023howA share link meant for one folder opens the whole storage account.what leavesbackups, passwords and private messageswho ends up with itanyone who finds the link
- or it goes like thisit happenedToyota cloud exposure, 2023howA wrong setting is never rechecked and stays open for years.what leavescustomer data, over a long stretch nobody can account forwho ends up with itnobody knows, which is the problem
sources
your turn
what you can do about it
this week
Pick one SaaS or low-code platform and review the defaults you never changed.
Your SaaS and low-code platforms ship with defaults you have probably never reviewed, some of which favor convenience or visibility over protection. Power Apps is the reminder that out of the box is not the same as secure. Which of your platforms' defaults you have actually checked is the gap it exposes.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →