Public by Default: Sensitive Files Pulled From an Open Azure Blob Container

A sensitive-data exposure caused entirely by a storage misconfiguration. A developer set a production Azure Blob container's public access level to anonymous, an external actor swept the *.blob.core.windows.net namespace and found it, listed it with an unauthenticated List Blobs call, then bulk-downloaded the exports — including a config file with a SQL connection string and a nightly database backup — with AzCopy over anonymous HTTPS. Reconstruct the exposure from Azure Storage diagnostic logs and SIEM corroboration, classifying the discovery and collection techniques, in a case where nothing failed and no credential was ever used.