Nextcloud Leak Exposes 367,000 Client Files and Emails

Nextcloud built its brand on a simple pitch: keep your files off the big platforms and on infrastructure you control. That pitch took a hit in July 2026, when researchers found the company's own back office data sitting unprotected on the open web. Nobody broke in. A database was simply left without a password, and anyone who found it could read invoices, internal emails, and setup scripts belonging to Nextcloud's paying customers.

Key Takeaways

• Cybernews researchers found an unprotected Elasticsearch cluster belonging to Nextcloud GmbH on May 18, 2026, containing roughly 367,000 records across about 8 GB of data.
• The exposed files included invoices, contracts, internal emails, employee details, and deployment scripts Nextcloud built for individual client projects.
• Email domains and business records in the archive named IONOS and STRATO, two major German web hosting providers, along with MSB NRW, North Rhine Westphalia's Ministry of Schools and Education.
• Nextcloud secured the database on May 27, 2026, two days after researchers notified the company, and reported the incident to its state data protection authority.
• Nextcloud says the leak came from a misconfiguration in its own hosting infrastructure and that no customer or partner run Nextcloud servers were affected.

What Happened?

A misconfigured Elasticsearch cluster belonging to Nextcloud's managed hosting business was reachable by anyone on the internet, no login required. According to Cybernews, the research team that discovered the exposure, the cluster held close to 367,000 records totaling roughly 8 GB. That is not the open source software millions of people self host. It is the internal database Nextcloud GmbH uses to run its own managed hosting and support operations.

Reporting from German outlet heise online puts the discovery date at May 18, 2026. Researchers notified Nextcloud roughly a week later, on May 25, and the company closed the database two days after, on May 27. That gap is normal in responsible disclosure, but it means the data sat exposed for over a week before anyone with a login noticed.

Whose Data Was Exposed?

The archive mixed Nextcloud's own employee records with business data belonging to its clients. Per German tech outlet Golem's reporting on the leak, the exposed files included invoices sent to and received from customers, contracts, internal email correspondence, employee details, and setup scripts written for specific client deployments. Email domains and company names inside the leak identified IONOS and STRATO, two of Germany's largest web hosting providers, along with MSB NRW, the Ministry of Schools and Education of the state of North Rhine Westphalia.

Invoices and contracts read like private paperwork, but they carry exactly what a scammer needs to write a convincing message: real vendor names, real amounts, real contacts. Researchers flagged the deployment scripts as a separate risk, since scripts written to configure a client's Nextcloud instance can reveal how that system is structured, narrowing down where to look for a way in.

How Did Nextcloud Respond?

Nextcloud closed the exposed database within two days of being contacted and told Cybernews it found no evidence the data was misused. The company attributed the incident to a misconfiguration in its own hosting infrastructure, not a flaw in the Nextcloud software, and said customer, partner, and other user run Nextcloud servers were not affected. It also reported the incident to its state data protection authority, a step Article 33 of the EU's GDPR requires within 72 hours of becoming aware of a personal data breach.

No confirmed evidence of unauthorized access has surfaced, but that is a different claim than "no one accessed it." An open Elasticsearch cluster with no authentication is exactly the kind of target automated internet scanners find within hours, well before a human researcher stumbles onto it.

Why This Is a Bigger Story Than One Vendor's Mistake

Nextcloud markets itself as the antidote to Big Tech data hoarding, the tool privacy conscious organizations pick to keep their files out of Google Drive and Microsoft OneDrive. That positioning makes this leak land differently than a routine SaaS misconfiguration. It follows the same pattern as the Accenture breach that put 35GB of source code up for sale and the KDDI breach that exposed 14 million email logins: the breach vector was misconfiguration, not malware. No exploit, no phishing email, no zero day. Just a database someone forgot to lock.

For security teams, that is the uncomfortable part. A privacy focused vendor with a decade of open source credibility still left an internal database open on the public internet for over a week. If Nextcloud, a company whose entire business rests on data sovereignty, can leave its own back office exposed, the assumption that a vendor's product philosophy predicts its operational security is worth retiring.

Why Email Users Should Care

Most people never send Nextcloud a file directly, but organizations that use Nextcloud's managed hosting generate a steady stream of invoices, contract updates, and support emails with the company. If your employer, school district, or IT provider uses Nextcloud's managed service, some of that correspondence may have sat in this exposed database.

The more immediate risk lands in your inbox regardless of whether you have heard of Nextcloud before. Leaked invoices and internal emails are raw material for business email compromise, a crime type the FBI's Internet Crime Complaint Center says cost victims $3.04 billion across 24,768 reported incidents in 2025. An attacker who read a real invoice thread between Nextcloud and a client like IONOS or STRATO has the vendor name, billing cadence, and tone of genuine correspondence needed to send a convincing follow up email asking finance to update a payment method. That is the same playbook behind most invoice fraud, and it works better with details stolen from a real vendor relationship than with a generic template.

How Should You Respond?

A handful of concrete steps reduce your exposure whether or not your organization used Nextcloud's managed services.

Check whether your organization is a Nextcloud managed services customer. IT or procurement teams should confirm directly with Nextcloud whether their account data appeared in the exposed set, rather than assume the company would proactively name every affected client.

Scrutinize invoice and payment change requests for the next few months. If your finance team has any relationship with Nextcloud, IONOS, or STRATO, verify unexpected payment detail changes through a second channel, like a phone call to a known contact, before acting on them.

Treat unsolicited Nextcloud, IONOS, or STRATO branded email with extra suspicion. Attackers who read real support threads can mimic a vendor's writing style and reference real project details, which is exactly what makes template based phishing filters miss them, a pattern also seen in the 24 billion credential infostealer dump feeding this year's wave of targeted phishing.

Ask your vendors how they store your correspondence. Every invoice and support email you send lives on someone else's server, often indefinitely, and few organizations ever ask a vendor how long that data sticks around or who can see it.

The Bottom Line

Nextcloud's core software was never touched. What leaked was the mundane back office paperwork every vendor generates: invoices, contracts, emails, and setup notes. That paperwork is exactly what makes a follow up phishing email convincing, which is why this leak deserves the same scrutiny as a credential dump, even though no login or source code changed hands. See our coverage of the Sysco breach where ShinyHunters dumped 2.7 million emails after a ransom deadline passed for more on how leaked correspondence turns into follow on attacks.