Attack #10: Cloud Misconfiguration Abuse

When security gaps are created by configuration, not intrusion

Threat snapshot – Cloud Misconfiguration Abuse

How the attack works

Cloud attacks do not always begin with malicious code.
Sometimes they begin with a configuration mistake.

As organizations adopt cloud platforms and services, environments grow faster and become more complex. Security settings, permissions and visibility do not always evolve at the same speed.

Attackers look for these gaps.

Common examples include:

• publicly exposed storage
• overly broad permissions
• exposed cloud services
• weak identity controls
• forgotten or unmanaged resources

Unlike traditional attacks, cloud misconfiguration abuse often does not require breaking into systems.

The access may already exist.

That is what makes these incidents difficult and increasingly common.

Real-World Cases

The following incidents demonstrate how cloud misconfigurations can lead to major security incidents. In both cases, the cloud platform itself was not compromised. Instead, incorrect access permissions, service configurations, and insufficient configuration management created the exposure.

Capital One (United States, 2019)

Sector: Financial Services

How did the incident begin?
The attacker exploited a misconfigured Web Application Firewall (WAF) to obtain temporary credentials from the AWS Instance Metadata Service. Those credentials inherited the permissions of an overly permissive Identity and Access Management (IAM) role, allowing access to Amazon Simple Storage Service (Amazon S3) resources beyond their intended scope.

What was compromised?

• data belonging to approximately 106 million applicants and customers;
• around 140,000 Social Security Numbers;
• approximately 80,000 bank account numbers;
• personal information, credit scores, and credit card application data.

How did the attack develop?
After obtaining the temporary credentials, the attacker enumerated available Amazon S3 resources and extracted data from multiple cloud storage locations accessible through the compromised IAM role.

Operational and financial impact

• approximately 106 million affected individuals;
• estimated response and recovery costs of US$100–150 million;
• significant regulatory, financial, and reputational consequences.

What could have reduced the impact?

• implementation of the Least Privilege principle;
• stricter Identity and Access Management (IAM) policies;
• automated cloud misconfiguration detection;
• monitoring for abnormal credential usage;
• regular Web Application Firewall (WAF) configuration reviews.

Microsoft Power Apps (2021)

Sector: Public Sector, Healthcare, Transportation, and Enterprise Services

How did the incident begin?
Researchers from UpGuard discovered that multiple Microsoft Power Apps portals exposed sensitive information because of incorrectly configured access permissions. No vulnerability in the Microsoft cloud platform was exploited.

What was compromised?

• more than 38 million publicly accessible records;
• data belonging to at least 47 organizations;
• phone numbers, home addresses, email addresses, Social Security Numbers, vaccination records, and employee information.

How did the incident develop?
Because access permissions were configured incorrectly, sensitive information became directly accessible over the internet without authentication or exploitation of any software vulnerability.

Operational and financial impact

At least 47 organizations were affected, including American Airlines, Ford, J.B. Hunt, Maryland Department of Health, and New York City Public Schools. Following the disclosure, Microsoft changed the default configuration for new Power Apps portals, while affected organizations conducted urgent reviews of their cloud environments.

What could have reduced the impact?

• continuous discovery of publicly exposed cloud resources;
• automated cloud configuration assessments;
• default-deny access policies;
• regular permission and access reviews;
• continuous cloud security monitoring.

What do these incidents show?

Both incidents demonstrate that the cloud platform itself was not the root cause.

In the Capital One incident, excessive permissions contributed to the exposure of data belonging to approximately 106 million people. In the Microsoft Power Apps incident, incorrect access settings exposed more than 38 million records belonging to at least 47 organizations, without exploiting a vulnerability in the platform.

The common lesson is that cloud security depends not only on the provider, but also on proper configuration management, identity and access governance, and continuous monitoring of cloud environments. A single configuration error can expose millions of records and create significant operational, regulatory, and reputational consequences.

Who they most often target

Cloud misconfiguration abuse targets environments where cloud adoption outpaces governance.

Roles

• cloud administrators
• DevOps and infrastructure teams
• SaaS platform owners
• users managing cloud resources

Sectors

• technology
• healthcare
• finance
• e-commerce
• public sector

Organization types

• cloud-first organizations
• hybrid environments
• fast-growing companies
• businesses with decentralized cloud management

The more services are deployed, the harder configuration consistency becomes.

What the attack relies on

Cloud incidents often emerge through a combination of speed and limited visibility.

Human factors

• configuration mistakes
• lack of cloud security knowledge
• rushed deployments
• overreliance on defaults

Technical gaps

• exposed storage
• weak identity protection
• missing monitoring
• excessive permissions

Process weaknesses

• lack of cloud governance
• inconsistent configuration reviews
• unclear ownership
• insufficient auditing

Cloud exposure is often accidental, but attackers exploit it intentionally.

How it is detected

Detection depends on understanding how cloud environments normally behave.

What users may notice

• unexpected resource activity
• unfamiliar access notifications
• service disruptions

What IT teams observe

• exposed assets
• unusual API activity
• abnormal configuration changes
• suspicious permission usage

What SOC teams detect

• cloud identity anomalies
• privilege abuse
• suspicious access patterns
• exposure of sensitive resources

Cloud incidents are often discovered through visibility rather than alerts alone.

How impact is contained

Response must focus on reducing exposure quickly.

Immediate priorities include:

• restricting exposed resources
• reviewing permissions
• disabling unauthorized access
• preserving logs and cloud activity records
• assessing affected assets and data

What does not help:

• assuming exposure means compromise
• ignoring misconfigurations because “nothing happened”
• delaying corrective actions

Exposure creates opportunity.
Response reduces it.

What realistically helps

Cloud security depends on consistency and visibility.

People

• cloud security awareness
• secure deployment practices
• accountability for cloud ownership

Processes

• cloud governance
• configuration reviews
• asset inventory
• access reviews

Technology

• cloud security posture management (CSPM)
• identity monitoring
• logging and monitoring
• least privilege enforcement

Cloud security is not only about platforms.
It is about configuration discipline.

Common myths

“Cloud providers secure everything”
“If access is authenticated, it is safe”
“Cloud environments are automatically protected”
“Misconfigurations are minor issues”

In reality, many cloud incidents begin with visibility and configuration gaps.

Attack #1: Phishing & Social Engineering

Attack #2: Credential Abuse & Account Takeover

Attack #3: Business Email Compromise (BEC)

Attack #4: Ransomware

Attack #5: Supply Chain Attack

Attack #6: Insider Threat

Attack #7: Malware & Infostealers

Attack #8: Data Exfiltration

Attack #9: Privilege Escalation & Lateral Movement

Next: Attack #11 – Distributed Denial of Service (DDoS) & Service Disruption