Security Incident Memo

Summary: On July 14, 2026, a misconfigured backup script on the payments-gateway staging host exposed a database snapshot to a publicly readable S3 bucket (brightpath-staging-artifacts) for approximately 6 hours before detection. The snapshot contained records for 4 test/demo customer profiles carrying realistic-format data, plus service credentials used by the backup job.

Exposed data included:

• Customer record: Elena T. Cho, card ending 1967, billing ZIP 97214
• Employee record: Rachel M. Voss, SSN 521-84-3390, DOB 03/14/1987
• Service credential embedded in backup script: AWS_ACCESS_KEY_ID=AKIAUJZDE8GXD6NCF10E
• Internal-only endpoint reference: https://ops-console.internal.brightpathtech.local/admin

Root cause: The nightly backup Lambda function (backup-staging-db) had its target bucket ACL changed during a Terraform apply on July 13 that inadvertently removed the private canned ACL override, defaulting the bucket to account-level settings which had public-read enabled for an unrelated static assets bucket sharing the same Terraform module.

Remediation actions taken:

• Bucket ACL restored to private; public access block enabled account-wide.
• IAM access key AKIAUJZDE8GXD6NCF10E rotated and old key deactivated.
• CloudTrail review confirmed no external download requests logged during the exposure window.
• Terraform module updated to hard-fail if public-read is ever set on any bucket.

Follow-up: Legal to assess breach notification obligations; Compliance to confirm whether the 4 affected demo profiles require customer notification under state law even though downloads were not observed. Report back to CISO by July 30, 2026.