Cybersecurity Alert: Major Data Breach Exposes Millions of Records in Cloud Storage Misconfiguration A significant data breach has exposed over 10 million sensitive records due to a misconfigured cloud storage bucket, security researchers at Wiz discovered on June 12, 2024. The incident involved an unsecured Amazon Web Services (AWS) S3 bucket belonging to HealthNow, a U.S.-based healthcare technology provider, which left patient data, internal documents, and proprietary software code publicly accessible for at least three weeks before detection. The exposed data included personally identifiable information (PII) such as names, addresses, medical IDs, and partial payment details, as well as internal API keys and credentials that could enable further attacks. Researchers noted that the bucket lacked basic security controls, including password protection and encryption, despite housing highly sensitive material. While there is no evidence of malicious exploitation yet, the breach highlights persistent risks tied to cloud misconfigurations, a leading cause of data leaks in recent years. HealthNow has since secured the bucket and launched an internal investigation, though the company has not publicly confirmed the full scope of the exposure. The incident underscores the ongoing challenges organizations face in cloud security hygiene, particularly as reliance on third-party storage solutions grows. Regulatory bodies, including the U.S. Department of Health and Human Services (HHS), may review the case under HIPAA compliance standards, given the healthcare-related data involved. This breach follows a string of similar incidents in 2024, where unsecured cloud storage has led to large-scale exposures across industries, from financial services to government contractors. Security experts emphasize that such vulnerabilities are often preventable with automated monitoring tools and access controls, though human error remains a critical factor in misconfigurations. The full impact of the breach, including potential downstream risks from exposed credentials, is still being assessed.