Security Firm APIsec ai Exposes Customer Data
Cybersecurity company APIsec.ai has exposed customer data due to a misconfigured Elasticsearch database. The leak, discovered by UpGuard, contains data from the firm which claims to serve 80% of Fortune 100 companies.
Event Summary
On April 22, 2026, the cybersecurity firm UpGuard announced it had secured an unprotected database belonging to another security company, APIsec.ai. APIsec.ai is an API security platform that claims to be used by 80% of the Fortune 100 companies. This situation presents an ironic picture, as a security firm failed to protect its own data.
The source of the leak was a publicly accessible Elasticsearch database. Elasticsearch is a popular search engine used for quickly searching and analyzing large datasets. However, when misconfigured, all the data it contains can become accessible over the internet without authentication.
Leaked Data
According to the UpGuard report, the leaked database contained data belonging to APIsec.ai's customers. The initial report did not share a detailed list of the types or volume of data exposed. However, considering that its customers include some of the world's largest corporations, the leak has the potential to contain sensitive corporate information. You can find the latest incidents in the Data Breach News section.
Has your email been leaked? Check for free — results in seconds.
Check Now →What Affected Users Should Do
Those directly affected by this leak are the corporate customers of APIsec.ai. It is recommended that these companies take the following steps:
- Contact APIsec.ai: They should request direct information about the scope of the leak and its specific impact on their company.
- Conduct an Internal Audit: They should review API keys, credentials, and access logs associated with the APIsec.ai platform.
- Monitor for Suspicious Activity: They should strengthen their monitoring mechanisms to detect unusual movements in their systems and API traffic.
You can use Data Breach Search tools to check if your personal data has been involved in a leak.