302.AI aggregator left Azure storage with 17.6 million files and chat logs publicly accessible
What happened
Cybernews found a publicly accessible Azure storage bucket belonging to the AI aggregator 302.AI holding about 17.6 million files and more than 144,000 chat logs. Some logs contained names, birth dates and addresses, and customer-support chatbot logs from a company using the service. Cybernews saw it closed by 8 September; it is not known whether others accessed it.
302.AI is run by Univerads Technology Limited of Hong Kong. The exposed bucket held about 22.7 TB, including more than 144,000 chat log files and over 26,000 zip archives of conversations. Some logs included names, birth dates, genders, contact details and home addresses, and others came from a customer-support chatbot owned by a manufacturer that the article does not name.
Cybernews says it found the bucket on 2 August 2026, made its initial disclosure on 11 August and saw it closed on 8 September. It is unclear who maintained the bucket, how long it was open and whether anyone else downloaded the data.
How it happened
Leaky AI product: Exposed datastore. A database, storage bucket or server behind an AI product was left open on the internet without a password.
Sources do not say whose AI model was involved. The product was 302.AI, a type of chatbot.
Impact
Data was exposed. Data involved: chat logs, personal data and internal documents. The impact was confined to one organization and its users or customers.
Severity is rated Medium, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It became public on 22 Oct 2026.
Cybernews reports that the data was taken offline after its outreach. At publication the article reported no reply from the company, and it did not say whether users were notified.