DeepSeek unprotected database exposed over one million user records
Security researchers discovered that DeepSeek left a database containing over one million user records unprotected on the internet. The company had no official process for receiving vulnerability reports and secured the database only after researchers contacted arbitrary contact points. It is unknown whether anyone accessed the exposed data.
What happened
Security researchers from the US cloud security firm Wiz discovered an unprotected database containing sensitive DeepSeek data publicly accessible on the internet.
The exposed database contained more than one million user records, including user inputs. DeepSeek had left one of its important databases unprotected online.
After Wiz researchers reported the vulnerability to DeepSeek by sending messages to arbitrary company email addresses and LinkedIn profiles (due to no official security contact point), DeepSeek shut down access to the database within half an hour.
Reported impact
Sensitive user data was accessible to anyone on the internet for an unspecified period of time.
It remains unclear whether anyone accessed or downloaded the exposed data prior to the database being secured.
Index analysis
The incident occurred after DeepSeek had recently topped app charts and put pressure on established providers like OpenAI.
Governance controls
DeepSeek had no official security contact point or disclosure process for handling vulnerability reports from researchers.
Researchers were forced to send vulnerability notifications to arbitrary email addresses and LinkedIn profiles they found or guessed.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.