Nextcloud leaks 367K records — European cloud giant exposes staff and clients in major breach

Cloud in Hand.

• Exposed ElasticSearch cluster at Nextcloud contained ~367k records (8GB), including employee data, client contracts, and scripts
• Sensitive information such as staff emails and client company details was left unencrypted; Nextcloud secured the archive within two days after notification
• Company attributed the incident to hosting misconfiguration, stressing customer servers were unaffected, though researchers warn attackers may have accessed the data

European cloud provider Nextcloud kept an unprotected database on the public internet, exposing sensitive internal and client data to anyone who knew where to look, experts have revealed.