Database of 20M+ tax records including sensitive personal and financial information of Russian citizens was found exposed online in an AWS Elasticsearch cluster
20 million tax records belonging to Russian citizens were found exposed online, accessible to anyone with a web browser.
Context & Ripple Effects
This is the second major Russian citizen-data exposure in five months: in May, a researcher surfaced 2.25M citizens' records leaking through Russian government sites, and now a far larger trove — 20M+ tax records with financial detail — has been found open to any browser in an AWS Elasticsearch cluster. It also lands in a year-long pattern of Elasticsearch and NoSQL misconfigurations at national scale, from the 3.5M Panama citizen records in an unprotected Elasticsearch cluster in May to Ecuador's near-full-population exposure in September.
First-order effects
- Roughly 20 million Russian taxpayers now have sensitive personal and financial data exposed to anyone with a web browser, with no authentication or encryption standing between the cluster and arbitrary visitors.
Second-order effects
- The recurring role of AWS-hosted open databases — echoing the 2016 Mexican voter-record exposure on AWS (article 868479) and May's Indian MongoDB leak (article 941523) — puts pressure on cloud providers to ship safer defaults and on customers to prove they configured storage correctly.
Third-order effects
- A steady drumbeat of country-scale exposures spanning Mexico, Panama, India, Ecuador, and Russia points toward misconfigured databases being treated less as isolated incidents and more as a systemic class, strengthening the case for regulation that penalizes insecure defaults rather than only breaches.
The trend: National-scale citizen databases are migrating to cloud infrastructure faster than operators secure them, making unauthenticated Elasticsearch and NoSQL clusters a recurring global exposure pattern.