Nextcloud: 367,000 records exposed (invoices, emails, scripts)

On May 18, 2026, Cybernews researchers found a publicly accessible ElasticSearch database containing Nextcloud’s internal data (open‑source European vendor). After being notified on May 25, Nextcloud closed the exposure on May 27, 2026, and says it informed the competent German authority. According to Cybernews, about 7.92 GB and 367,000 records were accessible: invoices, emails (.eml), contracts, employee information, and integration scripts (shell/Python), sometimes with plaintext credentials. Nextcloud says there is no evidence of malicious exploitation and attributes the issue to hosting infrastructure misconfiguration, not to the Nextcloud software itself.

Legal basis

• GDPR Article 32 (security of processing): public exposure of personal data suggests potential gaps in technical and organizational measures (access control, encryption, secure configuration). See our reference page on GDPR security obligations.
• GDPR Article 33 (notification): notify the authority within 72 hours after becoming aware, describing the breach, impacts, and measures.
• GDPR Article 34 (communication to data subjects): required if high risk (e.g., targeted phishing via invoices/contracts or scripts containing secrets).
• NIS 2: may apply if an essential/important entity is affected through use of the exposed services or scripts; otherwise GDPR remains central.

Impact for Luxembourg organizations

• Supplier fraud and social engineering: real invoices and contracts can power convincing targeted scams.
• Technical secrets in scripts: hardcoded credentials (DB, technical accounts) may enable unauthorized access.
• SaaS supply chain: treat this as a third‑party control point in your processing register and vendor risk assessments.

Actions to take this week

• Check your exposure: have Procurement/Finance/IT search for your legal names and contacts in any related invoices/contracts; issue an internal invoice‑fraud alert.
• Sanitize scripts and secrets: inventory Nextcloud integration scripts/guides; remove hardcoded keys, rotate credentials/tokens, use a secrets vault; log and monitor admin access. A targeted cybersecurity audit on configs and secrets can accelerate these checks.
• GDPR 33/34 process: if personal data is affected, trigger your breach procedure (qualification, risk analysis, CNPD notification within 72h if needed, evidence of corrective measures). For hands‑on support, see our DPO mandate and notification support.
• Payment‑fraud controls: four‑eyes on any IBAN/vendor changes, out‑of‑band verification, alerts for spoofed emails. Consider adding compromised credential and leak monitoring for early warning.

Timeline and sources

Discovered: May 18, 2026 • Notified: May 25, 2026 • Closed: May 27, 2026 • Cybernews publication: July 8, 2026 (updated July 9) • TechRadar Pro coverage: July 10, 2026. Sources: Cybernews; TechRadar Pro.

Article generated by Luxgap regulatory watch. For tailored guidance on this topic, contact us.