About 16,000 Supabase databases found exposing personal data

UpGuard says about 16,000 Supabase databases publicly expose personal data through customer configuration, not a named flaw.

Cybersecurity firm UpGuard told TechCrunch it found about 16,000 Supabase-hosted databases exposing some personal data on the public web, in reporting by Zack Whittaker. Exposed fields included names, addresses, and phone numbers, along with a smaller number of passwords and authentication tokens. Cited examples included an African government consulate in France, a U.S. valet service’s license plates, an immigration service’s contacts, and a virtual SIM farm used to intercept one-time passcodes. DataBreaches.net’s follow-up describes the same roughly 16,000 databases and frames the issue as customer misconfiguration and leakage rather than a named Supabase vulnerability or confirmed intrusion. Supabase CISO Bil Harmer said projects are secure by default and that customers control their own configuration. The sources agree on the approximate count and do not report a material disagreement.

• UpGuard told TechCrunch it found about 16,000 Supabase-hosted databases exposing some personal data on the public web.
• Exposed fields included names, addresses, and phone numbers, plus a smaller number of passwords and authentication tokens.
• Examples included an African government consulate in France, a U.S. valet service’s license plates, an immigration service’s contacts, and a virtual SIM farm used to intercept one-time passcodes.
• Zack Whittaker reported the findings for TechCrunch on 2026-09-25; DataBreaches.net summarized the same account on 2026-09-26.
• Both reports attribute the exposure to customer configuration and data leakage, not a named Supabase vulnerability or confirmed intrusion.
• Supabase CISO Bil Harmer said projects are secure by default and that customers control their own configuration.