No need to hack when it’s leaking: Roomster edition

**Executive summary:** A security researcher discovered a misconfigured Roomster server exposing millions of files (an estimated 44 million since mid-2022) including hundreds of thousands of images containing sensitive PII such as driver’s licenses and passports; Roomster did not respond to the researcher’s disclosure, the researcher notified the New York State Attorney General, and the exposed data were secured on December 21, though there is no clear evidence presented of attacker access or subsequent notifications to affected individuals.