What happened
In March 2025 researchers reported that hardware retailer Sydney Tools had left a ClickHouse database unprotected and publicly accessible, exposing details of more than 34 million online orders — customer names, email addresses, home addresses, phone numbers and items ordered — plus records of more than 5,000 current and former employees, including names, salaries, sales targets and branches [cybernews-st], [st-cyberdaily]. This was an exposure through misconfiguration rather than a hack, and no evidence of malicious access was reported. The order count is a count of orders, not people; the number of distinct individuals affected was not confirmed and is not estimated here.
Timeline
- 2025-03 — Researchers reported the unprotected database exposing 34M+ order records [cybernews-st], [st-techradar].
- 2025-03-26 — Cyber Daily reported the exposure, including employee records; Sydney Tools had not responded [st-cyberdaily].
Current status
Reported by researchers. At the time of reporting the database was still publicly accessible and Sydney Tools had not responded to requests for comment [st-techradar], [st-cyberdaily]. No company statement or regulator notification has been found.
Why it matters
A textbook cloud-misconfiguration exposure — a reminder that breaches don’t always require an attacker, just a setting left open.