12 Million IP Addresses Worldwide Expose Sensitive Credentials in Massive Security Misconfiguration Crisis

Over 12 million IP addresses worldwide are actively exposing sensitive credentials including API keys and database passwords through publicly accessible .env files, with the U.S. leading at 2.8 million exposed IPs, as security experts urgently call on organizations to rotate leaked credentials and implement stronger deployment safeguards immediately.

• Mysterium VPN researchers have discovered over 12 million IP addresses worldwide exposing publicly accessible .env files, leaking sensitive credentials including API keys, database passwords, JWT signing secrets, and cloud tokens.
• The United States leads with nearly 2.8 million exposed IPs, followed by Japan, Germany, India, France, and the UK, highlighting a global security misconfiguration crisis driven by preventable deployment errors such as missing deny rules and improperly scoped server directories.
• Security experts are urging organizations to immediately remove public access to exposed files, rotate all leaked credentials, and implement long-term defenses including centralized secret management, automated secret scanning in CI pipelines, and strict access controls to prevent routine deployments from becoming full-scale breaches.