Researcher finds unprotected Elasticsearch cluster exposing ~3.5M records of Panama citizens, including full names, dates of birth, and national ID numbers
Sergiu Gatlan / BleepingComputer :
Context & Ripple Effects
This Panama disclosure lands mid-wave of researcher-found Elasticsearch exposures: weeks earlier a misconfigured cluster at Chinese headhunting firm FMC Consulting spilled 20M+ resumes, and months later an unsecured server tied to a Chinese public security department leaked 90M+ records. The common thread is default-open deployments holding government-grade identifiers.
What makes the Panama case stand out within that arc is the record type — full names, dates of birth, and national ID numbers for roughly 3.5M citizens — the same class of state identifier seen when most of Ecuador's population was left exposed with home addresses later that year, and echoing the plain-text DNI listing on Equifax's Argentina employee portal two years prior.
First-order effects
- Whoever operates the cluster can no longer treat the exposure as private: any party who found the open instance holds name-plus-ID-number combinations for ~3.5M Panamanians, the minimum kit for identity fraud.
- The database owner faces immediate remediation work — locking down access, auditing what was queried — plus potential notification duties once the exposure becomes public through BleepingComputer.
Second-order effects
- Other Latin American organizations running Elasticsearch face pressure to self-audit before researchers find them first, since the Ecuador and China disclosures show the same scan-and-report playbook scaling from one country to the next.
- Vendors and integrators selling database deployments into the region get pulled into hardening conversations, because buyers now associate Elasticsearch misconfiguration with headline-level national leaks.
Third-order effects
- If the pattern holds, 'unauthenticated by default' becomes untenable for stores of national identifiers, pushing database vendors toward secure-by-default configurations and pushing states to treat citizen ID registries as critical infrastructure rather than ordinary IT assets.
- Continuous internet-wide scanning effectively ends security-by-obscurity for public-facing data stores: an open cluster is assumed discovered, shifting the burden onto operators to prove otherwise.
The trend: Researcher-driven scanning is turning misconfigured Elasticsearch clusters into a recurring channel for whole-population data leaks across Latin America and Asia, forcing default-security changes across the database industry.