September's breaches had one thing in common: assets nobody was watching

What happened

CM-Alliance's roundup of September 2026 covers a long list of incidents. A few stand out, with a caution that many of the numbers are early reports or attacker claims, not confirmed figures.

• A misconfigured cloud database at a Vietnamese passenger-data system was reportedly left open to the public, exposing around 220 million records with names, passport numbers and flight details.
• Aesto Health disclosed that someone had accessed part of its AWS infrastructure in December 2025. The disclosure came months later, covering about 9.5 million people.
• CenterPoint Energy had an attacker claim about 7.5 million customer records pulled through an externally reachable API. The company confirmed some personal information was taken. Services continued normally.
• Gyazo reportedly lost about 23.6 million user records after a flaw in its image-upload server let attackers run commands.
• An AI-assisted coding error at Bee Cheng Hiang exposed 95,364 customer email addresses.

So what for your business

Line them up and a pattern appears. A database nobody realized was public. A break-in disclosed months after it happened. An API that, by the attacker's account, gave away too much. A server that needed a patch. A code change that wasn't reviewed carefully enough.

None of these needs a sophisticated attacker. They need an attacker who finds the thing you forgot.

That's good news in one way. These are problems you can fix with inventory, basic review and monitoring, without buying anything exotic.

What to do this month

1. Find what's public. Scan your own domains and cloud accounts from the outside. Fix every storage bucket or database that's reachable and shouldn't be.
2. Authenticate and limit every API. Require sign-in, return only the fields needed, and set rate limits so bulk scraping gets noticed.
3. Decide how fast you'd notice. If someone downloaded your customer table tonight, which alert would fire?
4. Keep less data. Records you no longer need can't be stolen. Set retention periods and enforce them.
5. Review AI-written code like anyone else's. Especially anything that touches customer data or builds queries and exports.