how it happened
- whoanyone onlineno login needed
- the gapmisconfigured storagenever audited
- the result2.15M customerslocation data exposed
what everyone assumed
Misconfigurations feel like the kind of thing that gets caught: scanners run, audits happen, mistakes surface. The assumption is that an exposure cannot persist for long before someone, internal or external, finds it.
what happened
The setting stayed wrong for about a decade. No recurring audit checked it, so the data remained publicly accessible from late 2013 until discovery in 2023. The exposure was not exploited cleverly; it simply endured, unwatched, because nothing was watching.
step by step
- late 2013a cloud setting is left publicthe assumption breaks here
- no recurring audit checks itThe data stays open for about a decade.
- May 2023about 2.15 million customers affectedLocation and identifier data in Japan.
how it surfaced
In May 2023 Toyota disclosed that location and identifier data for around 2.15 million customers in Japan had been exposed for roughly ten years, attributing it to inadequate data-handling rules and a lack of setting audits.
A misconfiguration is not self-correcting, and without something that checks, an exposure can last for years.
Time does not surface mistakes; audits do, and their absence is how a decade passes.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersThe data sits open to the internet for years.what it costs youWhen it is found, you cannot say who looked at it in all that time.
- or it goes like thisit happenedMicrosoft AI data exposure, 2023howA share link meant for one folder opens the whole storage account.what leavesbackups, passwords and private messageswho ends up with itanyone who finds the link
- or it goes like thisit happenedPower Apps misconfiguration, 2021howA default on a no-code app leaves its data readable without logging in.what leavespersonal records you collectedwho ends up with itanyone who looks
sources
your turn
what you can do about it
this week
Name what rechecks your cloud and SaaS settings on a schedule.
Somewhere in your cloud and SaaS estate is a setting that was wrong when it was made and has never been rechecked. Toyota is the proof that nothing surfaces it on its own. Whether anything recurringly audits your configurations, rather than trusting them to be caught, is the gap that ran for ten years.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →