Fiverr Denies Data Leak After Sensitive User Documents Found Exposed Freelance marketplace Fiverr has refuted claims of a data breach following reports that sensitive user documents were publicly accessible via an exposed Cloudinary storage instance. The denial came in response to a Cybernews investigation, which alleged that an anonymous security researcher identified as "morpheuskafka" discovered the leak on Hacker News. According to Cybernews, the exposed Cloudinary instance, likely linked to Fiverr, contained invoices, tax forms, driver’s licenses, credentials, and other personally identifiable information (PII). The report confirmed that many of these documents had been indexed by Google, making them discoverable through search results. Security researcher Aras Nazarovas noted that the exposure stemmed from Fiverr’s use of public URLs for client-worker communications, rather than secured, expiring links. While the files were individually accessible, the full scope of the leak was limited to what search engines had already indexed, as listing all exposed documents required an account’s API key. Users on Hacker News reportedly shared links to the compromised files, raising concerns over the platform’s handling of sensitive data. In its response, Fiverr stated that the exposed content was shared voluntarily by users as part of marketplace activity, with buyer consent required for uploads. The company emphasized that it does not proactively expose private information and that removal requests are addressed promptly. Cloudinary has not yet commented on the incident.