Search engine Google dork query uncovering unprotected AWS S3 bucket documents and credentials

data leakage

Rapid7 Google hacks extended

How many other file sharing services are affected by the inadvertant sharing of sensitive information

John W8MEJ Menerick April 11, 2013 1-minute read Updated August 18, 2026

Key takeaways

A single misconfigured S3 bucket turns enterprise crown jewels into public search results.
Cloud adoption without automated permission boundaries is accidental public disclosure.
Reconnaissance using Google dorks still beats million-dollar intrusion suites against lazy configurations.

site:s3.amazonaws.com filetype:docx password username

site:s3.amazonaws.com filetype:pdf password username

site:s3.amazonaws.com filetype:pdf social security number confidential

site:s3.amazonaws.com “Form W-4”

site:s3.amazonaws.com “Form W-9”

site:s3.amazonaws.com “Form 1099”

How many other file sharing services are affected by the inadvertant sharing of sensitive information? I suspect there are many. And the results will not be noisey. Or better yet: Content delivery networks.

About the author

John W8MEJ Menerick

Explore cutting-edge cybersecurity insights and protective strategies with John Menerick. Deep dives, threat analysis, and live streams from securesql.info.

Research Speaking About

Related reading

Autonomous Incident Response at Scale: How Energy-Based Models & TAME Replace LLM Guessing in Security

Security Theater and Cap Tables: Deconstructing Cal.com's Closed-Source Pivot

Episode 2: The Layer 2 Bridge Lab