Top 10 Cloud Misconfigurations That Lead to Data Breaches

MITRE ATT&CK: T1530 (Data from Cloud Storage Object)

Cloud storage services are designed for easy accessibility, which sometimes leads developers to enable public access for testing or rapid sharing, never reverting that setting. The result: sensitive data such as customer records, database backups, or even credentials becomes accessible to anyone on the internet.

MITRE ATT&CK: T1078.004 (Valid Accounts: Cloud Accounts) · T1548 (Abuse Elevation Control Mechanism)

In many environments, users and service accounts are granted broad permissions simply for convenience. While this may speed up development, it dramatically increases the attack surface. If an attacker compromises such an account, they can escalate privileges and take control of critical resources across the entire environment.

MITRE ATT&CK: T1190 (Exploit Public-Facing Application) · T1133 (External Remote Services)

Opening sensitive ports such as SSH (22) or RDP (3389) to the entire internet exposes systems directly to automated scanners and targeted attackers. Without proper network segmentation, a single compromised service can become a foothold for lateral movement across the environment.

MITRE ATT&CK: T1530 (Data from Cloud Storage Object) · T1020 (Automated Exfiltration)

Data that is unencrypted (whether at rest or in transit) is vulnerable to interception and unauthorized access. This gap often occurs because encryption settings are not enabled by default, or because teams underestimate the sensitivity of the data they're storing.

MITRE ATT&CK: T1610 (Deploy Container) · T1613 (Container and Resource Discovery) · T1552.007 (Unsecured Credentials: Container API)

Kubernetes environments are powerful but notoriously complex, making them especially prone to misconfiguration. Leaving default settings unchanged, exposing the API server publicly, or failing to restrict the Kubernetes dashboard can give attackers a direct path into the cluster, and from there into everything it orchestrates.

MITRE ATT&CK: T1552.001 (Credentials in Files) · T1552.004 (Private Keys)

Hardcoding API keys, passwords, or tokens into source code or configuration files is one of the most persistent risks in modern development workflows. Once a repository is scanned (by a curious developer, an automated bot, or a malicious actor), those credentials can be reused to access systems and data almost immediately.

MITRE ATT&CK: T1562.008 (Impair Defenses: Disable Cloud Logs)

Logging and monitoring are often treated as optional extras, but their absence can be catastrophic. Without visibility into system activity, breaches can go undetected for weeks or months, giving attackers ample time to exfiltrate data, establish persistence, or cause further damage.

MITRE ATT&CK: T1190 (Exploit Public-Facing Application) · T1059 (Command and Scripting Interpreter)

APIs form the backbone of cloud-native applications, and insecure ones (lacking proper authentication, rate limiting, or input validation) can expose sensitive data or allow attackers to manipulate backend systems at scale.

MITRE ATT&CK: T1486 (Data Encrypted for Impact) · T1537 (Transfer Data to Cloud Account)

Backups are intended as a safety net, but they become a liability if not properly secured. Storing backups in the same environment as production systems (or leaving them publicly accessible) makes them easy targets. In a ransomware attack, compromised backups can turn a recoverable incident into a catastrophic one.

MITRE ATT&CK: T1190 (Exploit Public-Facing Application) · T1203 (Exploitation for Client Execution)

Many organizations mistakenly assume that cloud providers manage all patching, overlooking their own responsibilities within the shared responsibility model. Outdated operating systems, container images, and application dependencies leave systems exposed to known, publicly disclosed vulnerabilities.