New Zealand Property Firm Exposes 31,000 Sensitive Documents in AWS S3 Breach A misconfigured Amazon S3 bucket belonging to New Zealand’s LPM Property Management exposed over 31,000 sensitive documents, including passports, driver’s licenses, and ID verification photos tied to tenants, landlords, and maintenance records. The breach was discovered by Cybernews Security researcher Jake Dixon of Vadix Solutions, who alerted both LPM and CyberNews—but repeated attempts to contact the company went unanswered. The exposed data remained accessible for over a month before Amazon Web Services (AWS) intervened to secure the bucket. The leaked files, which included personally identifiable information (PII), could be exploited for identity theft, phishing, or dark web sales, with estimates valuing the cache at over $600,000. Declan Ingram of CERT NZ noted that the incident underscores the risks of poor cloud security practices, emphasizing the need for businesses to isolate sensitive systems, restrict access, and implement network segmentation. While AWS acted to close the breach, LPM has not responded to inquiries from researchers or media. The long-term impact on affected individuals remains unclear, though experts warn of potential fraud risks.