Their offsite backup was offsite — and wide open to the internet

Their offsite backup was offsite — and wide open to the internet

Company finally did the right thing: nightly DB dumps to cloud object storage. The bucket was public. A researcher found 2.3 million customer records — names, emails, hashed-but-weak passwords — sitting in plaintext backup files indexed by a search engine.

Fine: regulatory penalty in the low six figures, plus mandatory breach notices to every user.

An unencrypted, public backup isn't safety — it's a breach with extra steps. Encrypt at rest, lock the bucket. Change my mind.