On September 20, 2026, a Shodan scan picked up an Elasticsearch 8.15.0 instance exposing roughly 42 GB of data. The banner reported 167 million documents across 87 indices. By September 23, the endpoint was gone.
What the index names showed
The largest collections appeared to concern Russian vehicle, credit, corporate, telephone and personal information. Other indices referenced Kazakhstan residency registrations, criminal and debtor records, regional telephone directories, and business registries. A handful of smaller indices covered Slovakia, Canada, Colombia and Cuba.
Several distinctive names—including gibdd34m, credit_rf_201509, and larixperson—appeared alongside dozens of consistently formatted indices ending in -v1.
The naming was transliterated Russian, organized by geography and year. So, to me, it doesn’t look like an accidental collection. Someone had taken separate datasets and normalized them into a single search system.
The corpus was also heavily concentrated. larixperson and three gibdd-named collections accounted for roughly 54% of the reported storage. Adding the large credit, corporate-registry and telecom indices brought the concentration to approximately 69%.
What I can and can’t say
Based on the evidence, I’m confident this was a deliberately organized corpus of mostly Russian and Kazakh personal data. The structure makes that clear.
However, it does not identify the operator. This could have been a commercial broker, a lookup service, a criminal operation or something else. The names don’t prove how the data was acquired, whether all of it was stolen or whether the operator has any connection to a known threat group.
Of course, infrastructure can reveal an operation’s structure long before it reveals the people behind it.
The database disappeared
By publication, the endpoint was no longer exposed. That limits the immediate risk. But the passive record still shows what was there: 167 million documents organized across national, regional, and subject-specific datasets.
In this case, I think the most interesting part isn’t attribution, it’s the architecture. Someone took dozens of separate datasets, applied a consistent indexing scheme and built a searchable environment around them. The metadata is enough to understand the structure and intent of the operation.