Cybersecurity firm SOCRadar has disclosed a major data exposure involving a publicly accessible Elasticsearch server containing approximately 676 million United States identity records, including full Social Security Numbers.
The server, which contained 91.72 GB of data, required no authentication to access. Records included full names, dates of birth, home addresses, phone numbers, and Social Security Numbers. SOCRadar classified the exposure as Critical severity. The record count exceeds the current US population, suggesting the dataset aggregates historical records from multiple sources over time, with duplicates likely present.
SOCRadar validated samples from the dataset by cross-referencing records against publicly available data sources, confirming authenticity. The firm also noted that references to approximately 250 million related data entries had previously appeared on criminal forums, suggesting portions of the data may already be in circulation among threat actors.
The incident fits a recurring pattern SOCRadar has documented: Elasticsearch databases deployed with default settings that leave port 9200 exposed to the internet with no authentication layer. In prior cases, the firm identified a separate exposure of 544 million plain-text credentials and another involving 43 million records across three misconfigured servers.
SOCRadar followed responsible disclosure procedures and attempted to identify the data owner and hosting provider. At the time of publication, the owner remained unknown. The firm has ingested relevant indicators into its threat intelligence platform under controlled access.
The scale and content of this exposure make it particularly serious for the digital identity sector. Social Security Numbers and dates of birth are permanent, non-rotatable identifiers. Unlike passwords, they cannot be reset. Affected individuals face ongoing risk of identity theft, synthetic identity fraud, account takeover, and financial crime, regardless of any eventual remediation.
SOCRadar recommended that organizations restrict Elasticsearch instances to internal networks, require authentication, enforce IP allowlisting, and avoid exposing port 9200 to the public internet.
Sources: SOCRadar
–
By the Mobile ID World Editorial Team
