logo

Critical Elasticsearch Exposure: 544M Plain-Text Credentials Found Publicly Accessible

ID: a8491979-4c0e-5d3d-a843-ba395bfe629d

STIX ID: report--a8491979-4c0e-5d3d-a843-ba395bfe629d

Feed Name: SOCRadar Blog

Threat Score
90/100

Date Published: 2026-02-24

Date Updated: 2026-04-30

Author: Ameer Owda

...
...

SOCRadar discovered an unauthenticated, internet-facing Elasticsearch instance exposing ~544 million plaintext credentials (88.3 GB) in a URL:email/username:password format; the dataset is exploitation-ready and correlates with underground forum listings, posing immediate high risk for credential stuffing, account takeover, and large-scale automated abuse.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.