Data breach

Firebase misconfigurations expose user data on a massive scale

First reported 2024-03-11 · Last reported 2024-03-20 · 4 related reports

Firebase misconfigurations exposed millions of user records across more than 900 sites. The exposed data included 19 million plaintext passwords, and the total number of exposed secrets was put at more than 19.8 million.

Key facts

Affected organisation: Being confirmed
Incident type: Data breach
Occurred / detected: Not confirmed
Scale of damage: User data from more than 900 sites and more than 19.8 million secrets exposed
Cause / method: Firebase misconfiguration
Location: Other countries

If your data was exposed

Exposed dataPassword

Change your password, and also change it on any other site where you use the same one. Turn on two-factor authentication if available.

Timeline

2024-03-18It was reported that millions of user records had been exposed through Firebase across more than 900 sites.
2024-03-19It was reported that 19 million plaintext passwords had been exposed through misconfigured Firebase instances.
2024-03-20The number of secrets exposed due to Firebase misconfigurations was put at more than 19.8 million.

4 related reports

Hackers exploited WordPress Popup Builder plugin flaw to compromise 3,300 sitesSecurity Affairs · 2024-03-11
Millions of user records exposed by 900+ sites via FirebaseThe Register · 2024-03-18
Misconfigured Firebase instances leaked 19 million plaintext passwordsBleepingComputer · 2024-03-19
Misconfigurations in Google Firebase lead to over 19.8 million leaked secretsGitGuardian Blog · 2024-03-20

The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.