AI Apps Leak Millions of Users' Personal and KYC Data via Misconfigured Cloud Storage
Date: 2026-02-23
Attack vector: data-exfiltration
Category: real-world
Severity: Critical

Tracked by the OECD AI Incidents and Hazards Monitor (AIM) as OECD-AIM-2026-02-23-c4a6, dated 2026-02-23. Classified attack vector: data-exfiltration. See the AIM incident page (https://oecd.ai/en/incidents/2026-02-23-c4a6) and its cited news sources for full narrative detail.


Mitigations:

Architectural layers (MAESTRO):