EY, a global accounting firm, inadvertently exposed a 4TB SQL backup (.BAK file) on the public internet, containing highly sensitive data such as schema, stored procedures, API keys, session tokens, user credentials, cached authentication tokens, and service account passwords. The exposure was discovered by Neo Security researchers, who warned that such files typically hold all secrets stored in an organization’s database. While EY responded professionally and remediated the issue within a week, the researchers suspected threat actors may have already accessed the data before discovery. EY clarified that no client information, personal data, or confidential EY data was compromised, attributing the incident to an acquired entity under EY Italy, isolated from its global systems. However, the exposure posed severe risks, including potential breach escalation, credential theft, or ransomware infection, given the criticality of the leaked data.