Cybersecurity Alert: Major Data Breach Exposes Millions of Records in Cloud Storage Misconfiguration A significant data breach has exposed over 10 million sensitive records due to a misconfigured cloud storage bucket, security researchers at Wiz discovered on June 12, 2024. The incident involved an unsecured Amazon S3 bucket belonging to Brightly Software, a subsidiary of Siemens specializing in education and municipal management solutions. The exposed data included personal information (PII) such as names, email addresses, phone numbers, and in some cases, student and staff records from K-12 schools and local government entities using Brightly’s SchoolDude and Cityworks platforms. Financial documents, internal communications, and system credentials were also found in the unprotected storage. The misconfiguration stemmed from improper access controls, leaving the bucket publicly accessible without authentication. While there is no evidence of malicious exploitation, the exposure highlights persistent risks in cloud security, particularly for third-party vendors handling sensitive data. Brightly confirmed the breach after being notified by Wiz and secured the bucket within 24 hours, though the duration of the exposure remains unclear. The incident underscores the growing threat of supply chain vulnerabilities, as organizations increasingly rely on external providers for critical infrastructure. Regulatory bodies, including state-level education and privacy agencies, are expected to review the breach’s compliance with FERPA (Family Educational Rights and Privacy Act) and other data protection laws. Siemens has not issued a public statement beyond acknowledging the remediation efforts.