What Happens When an Elasticsearch Database Exposes 2 Million Sensitive Records?

Impact of the Data Leak

In July, Security Discovery director Bob Diachenko discovered an exposed Elasticsearch cluster containing almost two million JSON records with highly sensitive personal information such as names, nationalities, genders, birth dates, passport details and a "no_fly_indicator" flag. The server had been indexed by search engines Censys and ZoomEye, indicating that other parties could have accessed the data.

Diachenko’s analysis showed that many fields appear to come from a terrorist watchlist (the Terrorist Screening Center, TSC), while other fields like "tags", "nomination_type" and "selection_indicator" were difficult to interpret. Recognising the national‑security implications, he reported the breach to the U.S. Department of Homeland Security on July 19; the server was shut down three weeks later on August 9, 2021. Notably, the exposed database was hosted on a Bahrain IP address rather than a U.S. one.

Why Elasticsearch Frequently Leaks Data

Elasticsearch, released by Elastic in 2010, is a distributed open‑source search and analytics engine prized for its real‑time search capabilities. However, the open‑source version provides no built‑in data‑protection features, offering only basic firewall protection. This lack of security has led to multiple high‑profile leaks, such as the December 2019 exposure of over 2.7 billion email addresses from Tencent, Sina, Sohu and NetEase, and the May 2020 public access to a Thai telecom’s Elasticsearch database containing about 83 billion records (≈4.7 TB).

Experts recommend mitigating such risks by implementing authentication and authorization, encrypting data in transit, restricting access to internal networks, and establishing robust monitoring and incident‑response procedures to detect and contain breaches promptly.

References:

https://www.bleepingcomputer.com/news/security/secret-terrorist-watchlist-with-2-million-records-exposed-online/

https://cloud.tencent.com/developer/article/1580423