Security Firm APIsec Leaks Its Own Customer Data

What Happened

There’s no shortage of irony in the world of cybersecurity, but this latest incident is truly one for the books. A security company, tasked with protecting its clients, violates one of the most basic security principles and leaves its own customer data vulnerable in the middle of the internet. Yes, that’s exactly what happened. In a report published on June 1, 2026, security research firm UpGuard announced it had discovered a publicly accessible Elasticsearch database belonging to APIsec.ai, a provider of API security solutions. And this wasn't just any database. It contained a massive amount of sensitive information that could belong to APIsec's clients.

The story is a familiar one. A company sets up Elasticsearch, a powerful tool for data analysis and logging. It’s deployed quickly, maybe a developer set it up for a test, who knows. But in the rush, the most crucial step is skipped: setting a password. The result? A huge trove of data, containing the most intimate technical details of multi-million dollar companies, becomes accessible to anyone on the internet who knows the right address. This is precisely what UpGuard's cyber risk team did. While routinely scanning the internet for these kinds of open and vulnerable systems, they stumbled upon this server belonging to APIsec.ai. As soon as they realized the situation, UpGuard contacted APIsec, and thankfully, the database was quickly secured. But how long was it open? Who accessed it? These are the questions now haunting both APIsec and its clients.

This incident is the clearest cybersecurity equivalent of the old saying, "the shoemaker's children go barefoot." APIsec.ai is a company that proudly proclaims on its website that it serves 80% of the world's largest companies. They specialize in a highly niche and technical field: the security of APIs (Application Programming Interfaces). In other words, their job is to protect the digital doors and windows of the modern world. For them to forget to lock their own front door is a mistake that raises serious questions about trustworthiness for the entire sector.

What Data Was Exposed

So, what was behind this wide-open digital door? According to UpGuard's report, the leaked data is the stuff of a hacker's dreams. The database contained a rich dataset related to APIsec's own operations and client interactions. Listing it out helps to grasp the severity of the situation:

• Customer Information: Company names, employee email addresses, usernames, and contact details. This information is perfect for highly targeted spear-phishing attacks.
• API Keys and Tokens: This is perhaps the most dangerous part. API keys are digital keys that allow different systems to communicate with each other. If these keys belong to APIsec's customers, an attacker could use them to infiltrate those companies' systems directly, posing as an authorized user. It’s like stealing the master key to a bank's main vault.
• Internal System Logs: Server IP addresses, information about browsers users were using (user-agent strings), system error messages, and other technical logs. This data can be used to map out a company's internal network, identify weak points, and plan more sophisticated attacks.
• Security Scan Results (Potential): While UpGuard's report doesn't confirm this detail, it is highly probable that a company like APIsec would store the results or raw data from security scans performed for its clients in such a database. If true, this leak would have handed attackers a list of all known security vulnerabilities in the affected companies. It's equivalent to giving a burglar a list of which houses have no alarms and which windows are broken.

The combination of this data creates the potential for a chain-reaction disaster. An attacker could use the leaked email addresses to launch a phishing attack and steal an employee's password. With that password, they could access a system and use the leaked API keys to pivot to other systems. And while doing all this, they could use the information from the leaked system logs to cover their tracks more effectively. In short, this isn't just a data leak; it's a potential starter kit for cyberattacks against dozens of major corporations.

How the Attack Happened

There was no complex hacking operation, no months-long planning, no state-sponsored cyber army behind this breach. On the contrary, the incident stems from an embarrassingly simple mistake. UpGuard's report states that the source of the leak was an Elasticsearch database left open to the internet without password protection.

What does this mean? Elasticsearch is a popular open-source database technology used to search and analyze huge volumes of data very quickly. Companies often use it to collect application logs, user activities, or system metrics. It's a powerful tool, but also a major risk if not configured correctly. When installed with its default settings, it often runs without any authentication mechanism. This means anyone who knows the server's IP address can gain full access to all the data within it. Just like a warehouse with no lock on the door.

It's not difficult for attackers or researchers to find such open databases. There are specialized search engines like Shodan or Censys that scan every device connected to the internet (servers, cameras, refrigerators, you name it). A simple query on these search engines for something like "unprotected Elasticsearch servers" can list thousands of vulnerable systems worldwide in seconds. It's likely that APIsec's server was discovered in this way. Someone was either intentionally looking for such a server, or a well-intentioned research team like UpGuard came across it during their routine scans.

So, in essence, the breach wasn't even an "attack." It's more like leaving a bag full of valuables on a park bench and walking away. Who finds the bag first is purely a matter of luck. The fact that UpGuard found it is the best-case scenario here.

Who Is Affected

The primary victim of this leak is, without a doubt, APIsec.ai itself. They are facing one of the biggest reputational crises a security company can experience. Failing to protect their own data while selling security to their customers is a difficult mistake to forgive. However, the ones at greatest risk are APIsec's clients.

APIsec claims on its website that it is "used by 80% of Fortune 100 companies." If this claim is true, the potential impact of the leak is enormous. Who might these companies be? Financial giants, tech behemoths, healthcare providers, retail chains... in short, the very organizations that form the backbone of the global economy. Although the names of these companies were not disclosed in the report, the presence of customer lists in the leaked data could clearly reveal who was affected.

The victims aren't just these large corporations. Consider the ripple effect. The millions of end-users served by these large companies are also indirectly at risk. If a bank's API keys were leaked, that bank's customer data could also be compromised. If a major e-commerce giant's systems are breached, millions of users' credit card information could be at risk. Therefore, the cascading effects of the breach could be much wider than they appear at first glance.

In short, the list of those affected can be summarized as follows:

1. APIsec.ai: Facing the risk of reputational damage and customer loss.
2. APIsec's Corporate Clients: At direct risk of cyberattacks, data theft, and unauthorized access to their systems.
3. The Customers and End-Users of These Companies: Their personal and financial data may be indirectly compromised.

What You Can Do

Giving generic advice at this point is meaningless. Saying "change your password" is like trying to put out an ocean fire with a glass of water. The situation requires much more specific and serious steps. If this news concerns you, here’s what you need to do:

If you are an APIsec.ai customer (or suspect you might be):

• Act Immediately: Don't waste time. For a moment, assume that all your integrations with APIsec and all information you've shared with them have been "breached." This isn't a hypothesis; it's the starting point for an emergency action plan.
• Rotate All API Keys: Immediately revoke and replace all API keys, tokens, and other credentials that interact with APIsec systems or that you have granted APIsec access to. This is the digital equivalent of changing the locks when your house key is stolen.
• Demand an Official Statement: Contact your representatives at APIsec and request a clear, written report on how your company was affected by this breach. Demand to know what specific data of yours was exposed, how long the database was open, and any information they have on who might have accessed it.
• Initiate an Internal Audit: Launch an emergency audit of your own systems to check for any suspicious activity at points connected to APIsec. Look for abnormal API calls, unauthorized access attempts, or unexpected data transfers.

If you are a cybersecurity professional or IT manager:

• Use This as a Teachable Moment: This breach once again demonstrates how vital third-party risk management is. Re-evaluate the security policies and practices of all your vendors (especially your security vendors). Ask them the question: "How do you protect our data?"
• Scan Your Own Assets: Conduct regular scans of your own cloud infrastructure and corporate network to check for unprotected databases, open storage buckets (like S3), or misconfigured servers. Sometimes the biggest threat comes not from the outside, but from a simple internal mistake.

What the Company Says

According to the UpGuard report, which is the source of the news, APIsec.ai was cooperative after being notified of the leak and quickly secured the database in question. This is the correct first step to take in a crisis. However, as of the time of writing, APIsec.ai has not yet released a comprehensive public statement or blog post about the incident.

The company's website and social media accounts are currently silent. Typically, in such situations, companies conduct an internal investigation to fully understand the scope of the incident, determine their legal obligations, and communicate directly with their customers. During this process, they may refrain from making immediate public statements. However, for a firm that claims to serve 80% of Fortune 100 companies, this silence can increase the uncertainty and anxiety among affected clients. It is expected that APIsec will provide a detailed explanation, an apology, and a roadmap of the steps they will take to minimize the damage for their customers in the coming days or hours. Once that statement is released, we will have a clearer picture of the true scope and impact of the leak.

Source

https://www.upguard.com/breaches/data-leak-apisec