DeepSeek Database Leak: A Critical Security Vulnerability
Introduction
A major security vulnerability in DeepSeek’s database was discovered by SBComputer, exposing millions of records, including sensitive data. This discovery, made on January 28, 2025, highlights a critical flaw in data protection that left confidential information publicly accessible.
Uncovering the Vulnerability
During a routine cybersecurity audit, SBComputer identified an exposed ClickHouse database belonging to DeepSeek. The database contained over a million lines of sensitive data, including:
- AI chat logs & user interactions
- Internal API keys
- Backend configurations
- Other confidential system files
Proof of Concept (POC) Demonstration
After discovering the vulnerability, SBComputer reported it to the DeepSeek Team. Following their internal validation, the team patched the vulnerability on January 29, 2025. After receiving official permission, SBComputer disclosed the issue publicly through a live Proof of Concept (POC) on YouTube on January 30, 2025.
Technical Breakdown of the Issue
- The ClickHouse database was publicly exposed without authentication or firewall restrictions.
- Simple queries allowed access to highly sensitive data that should have been encrypted.
- No rate limiting or security checks prevented unauthorized bulk data access.
Exposed Ports
During the analysis, the following ports were found to be accessible:
- http://dev.deepseek.com:8123
- http://dev.deepseek.com:9000
- http://oauth2callback.deepseek.com:8123
- http://dev.deepseek.com:9000
Impact of the Leak
This security flaw had the potential to expose:
- ✅ User privacy violations
- ✅ Unauthorized API access, leading to misuse or fraud
- ✅ Intellectual property leakage
- ✅ Potential legal and compliance issues for DeepSeek
Why This Matters
The discovery raises critical concerns about AI companies’ responsibility in handling user data securely. As AI models are integrated into sensitive applications, data security should be a top priority for companies handling large-scale user-generated content.
Final Thoughts
This incident is a wake-up call for AI and tech companies to prioritize security from the beginning. If sensitive databases are left exposed, it questions security practices even among major AI firms.
For cybersecurity professionals and researchers: Always audit and report vulnerabilities responsibly.
For users: Stay informed and demand transparency from AI service providers regarding data protection.
Stay updated on cybersecurity threats and AI security practices:
Follow SBComputer for more in-depth analyses and security insights.
If you found this information valuable, share it to spread awareness about data security!
Hashtags:
#CyberSecurity #DataLeak #DeepSeek #AIsecurity #SBComputer