Cybersecurity firm SOCRadar has disclosed the discovery of a publicly accessible Elasticsearch server containing approximately 676 million indexed United States identity records, including full Social Security Numbers and complete identity profiles.
The exposed instance, which contained 91.72 GB of data across nearly 677 million records, required no authentication to access. Records included full names, dates of birth, street addresses, phone numbers, and Social Security Numbers — a combination that SOCRadar rated as Critical severity. The total record count exceeds the current US population, indicating large-scale data aggregation, historical retention, or multi-source identity consolidation over time, with duplicates and legacy entries likely present.
SOCRadar said it validated samples from the dataset, including cross-referencing one record against publicly available obituary data, which confirmed authenticity. The firm also noted that mentions of approximately 250 million related data entries had previously circulated on hacker forums, suggesting portions of the dataset may have already entered underground ecosystems.
The exposure follows a pattern SOCRadar has documented in prior incidents: Elasticsearch instances deployed with port 9200 exposed to the internet and authentication disabled. The firm previously identified a separate case involving 544 million plain-text credentials in a misconfigured Elasticsearch instance, and another involving 43 million records across three misconfigured servers.
SOCRadar initiated responsible disclosure procedures upon discovery, including outreach to identify the data owner and hosting provider. At the time of publication, the data owner remained unidentified. The firm said it ingested relevant indicators into its internal threat intelligence systems under controlled access policies.
The presence of Social Security Numbers alongside full identity profiles distinguishes this exposure from routine personally identifiable information leaks. SSNs and dates of birth are non-rotatable identifiers, meaning affected individuals face long-term risk of identity theft, financial fraud, synthetic identity creation, and account takeover regardless of any remediation action taken now. The exposure comes as CSIS has warned that large biometric and identity databases are high-value espionage targets.
SOCRadar recommended that organizations restrict Elasticsearch access to internal networks, enable authentication and role-based access controls, enforce IP allowlisting, and disable direct internet exposure of port 9200.
Sources: SOCRadar
–
By the ID Tech Editorial Team
