Report: 2,446 Android and 600 iOS apps using Google's Firebase service found to have misconfigured databases exposing 100M+ records of a wide range of user data
Catalin Cimpanu / BleepingComputer :
Context & Ripple Effects
This 2018 finding is the opening data point in what becomes a recurring failure mode for backend-as-a-service platforms: developers enable cloud databases without locking down permissions, and the records inside go public. The same researchers' playbook resurfaces six years later when [[a:850592|misconfigured Firebase instances again exposed 125M+ users' records, this time including plaintext passwords]].
In between, the pattern generalized beyond Firebase — [[a:963834|Zimperium found 14% of apps connecting to AWS or Azure had misconfigurations exposing user data]], and Ford and American Airlines apps leaked 38M records through Microsoft's Power Apps — making clear the problem is a category of developer error, not one vendor's product.
First-order effects
- The developers behind the 2,446 Android and 600 iOS apps named in the report face immediate remediation work: reconfigure database rules, assess what was exposed, and notify affected users.
- Google's Firebase team comes under pressure to change defaults so that new databases are private unless a developer explicitly opens them, rather than relying on per-app configuration.
Second-order effects
- Security research firms gain a repeatable franchise in scanning public cloud endpoints for open databases — the model behind the later Power Apps and Twitter API key disclosures — turning misconfiguration audits into a standing beat.
- Enterprises evaluating mobile vendors add backend configuration hygiene to procurement checks, since brand-name apps are repeatedly implicated alongside small developers.
Third-order effects
- If the pattern holds across Firebase, AWS, Azure, and Power Apps, the industry moves toward secure-by-default cloud services and automated configuration auditing, shifting liability debates toward the platform providers whose defaults permit the leaks.
- Regulators get a documented, multi-year record of the same exposure class recurring at scale, strengthening the case for breach-notification and data-protection rules that treat negligent configuration as a reportable event.
The trend: Misconfigured backend-as-a-service databases are becoming a structural, recurring class of mass data exposure that outlasts individual vendor fixes.