An Indian AI startup that helps businesses build custom chatbots has leaked almost 350,000 sensitive files after the data was left unsecured on the web.

Ahmedabad-headquartered WotNot left a massive collection of sensitive user information - including scans of passport and identity documents, medical records, resumes, travel itineraries and more - unsecured in a misconfigured Google Cloud Storage bucket.

Researchers at Cybernews uncovered the security problem on August 27 2024. The Google Cloud Storage bucket it found was storing 346,381 files - all accessible to anybody on the internet, no password required.

That lack of even the most basic security is woeful when you consider that the information contained in the wide-open storage bucket included documents that would make it easy for a cybercriminal to commit identity theft.

Cybernews attempted to inform WotNot of the problem on September 9th, and sent "multiple follow-up emails, including to alternative email addresses " According to the researchers, it took more than two months for the business to close the security hole.

WotNot told Cybernews that the bucket was used by free-tier users of its services, and that "the cause for the breach was that the cloud storage bucket policies were modified to accommodate a specific use case. However, we regretfully missed thoroughly verifying its accessibility, which inadvertently left the data exposed."

The AI chatbot company attempted to reassure its enterprise customers that they were not impacted by the security breach:

"For enterprise customers, we provide private instances to ensure security and compliance standards are strictly adhered to."

Frankly, it shouldn't matter if you are a non-paying user of WotNot or an organisation like Merck or the University of California that the company lists amongst its paying customers. No-one deserves to have their privacy treated so recklessly.

Somehow I doubt that WotNot was advertising one of the benefits of being a paid-up user, rather than sticking with the free tier, was that there was no security in place for those who weren't paying customers.

My advice? Never share sensitive information with an AI chatbot, as you can't be sure where it might be stored or what could be done with it... and in the case of services like WotNot you may not know how much care it is taking to keep it out of the hands of literally anyone else on the internet.