DeepSeek security breach - critical databases exposed, more than one million records reportedly leaked

News
By published

Worrying DeepSeek vulnerability apparently found

A person using DeepSeek on their smartphone
(Image credit: Adobe Stock)
  • A leaky DeepSeek database was discovered by researchers
  • The database allowed for total operation control takeover
  • An attacker could extract passwords, chat logs, and more

Not long after emerging onto the AI scene and significantly disrupting the US tech markets, a leaky DeepSeek database has reportedly been discovered online.

The ClickHouse database that belongs to DeepSeek was found by Wiz cybersecurity researchers, and allowed for full database operations controls.

The database has since been secured, but the researchers warn it could have exposed chat history, secret keys, backend details, log streams, API Secrets, and operational details.

Get Incogni at 55% off with code TECHRADAR

Get Incogni at 55% off with code TECHRADAR
Remove your personal information from the internet with ease. Incogni protects your online
identity and reduces unwanted robocalls and spam emails.

<p><em>Preferred partner (<a href="https://discounttrush.shop/news/content-funding-on-techradar"><em>What does this mean?<em>) 
View Deal

DeepLeak

The leaky database was apparently found within minutes of Wiz beginning its research, with the researchers noting that if exploited, the database operations would allow an attacker to escalate privileges within the DeepSeek environment.

The vulnerability was discovered after two open ports were found that lead directly to the ClickHouse database without any authentication checks. Upon further investigation, the researchers discovered they were able to run commands in the HTTP interface to access over 1 million sensitive log entries.

If abused by an attacker, the database could be exploited to access plaintext passwords, chat histories, API Keys and more. After Wiz notified the exposure to DeepSeek, the vulnerability was immediately addressed and secured.

The Wiz researchers recommend businesses looking to use and adopt AI tools into their workflow pay close attention to the security of each solution, and protect customer data from exposure when using AI platforms.

You might also like

Benedict Collins
Benedict Collins
Senior Writer, Security

Benedict has been with TechRadar Pro for over two years, and has specialized in writing about cybersecurity, threat intelligence, and B2B security solutions. His coverage explores the critical areas of national security, including state-sponsored threat actors, APT groups, critical infrastructure, and social engineering.

Benedict holds an MA (Distinction) in Security, Intelligence, and Diplomacy from the Centre for Security and Intelligence Studies at the University of Buckingham, providing him with a strong academic foundation for his reporting on geopolitics, threat intelligence, and cyber-warfare.

Prior to his postgraduate studies, Benedict earned a BA in Politics with Journalism, providing him with the skills to translate complex political and security issues into comprehensible copy.

You must confirm your public display name before commenting

Please logout and then login again, you will then be prompted to enter your display name.