A practical, slightly wry narrative for database security leaders.
The recent EY data breach exposed a critical gap in database security best practices: a 4-terabyte SQL Server backup containing unencrypted data was accessible on the open internet. This incident highlights why traditional database encryption methods—encrypting only at rest and in transit—fail to prevent data breaches when cloud misconfigurations occur. For CISOs and database administrators, the question isn’t if misconfiguration will happen, but when. The solution lies in encryption-in-use technology that keeps sensitive data encrypted throughout the entire data lifecycle, transforming potential breaches into manageable security audit findings.
CISO’s Log: Turning a 4-TB Headline into a Non-Event with Encryption-in-Use
It’s 7:12pm and the message comes in via an alert text. A researcher claims a 4-terabyte SQL Server backup is reachable on the open internet, DNS pointing straight at our brand. Deja vu. The situation mirrors the recent EY incident covered by The Register and the technical write-up by Neo Security: a colossal “.BAK” file exposed via a classic cloud bucket misconfiguration, reportedly unencrypted and chock-full of secrets.
Why Unencrypted Databases Create Data Breach Risk
- Plaintext rows yield plaintext backups. An unencrypted .BAK is a portable breach in a single file.
- Secrets mingle with business data. API keys, tokens, credentials often ride along within the tables.
- Automation finds mistakes fast. Internet-scale scanners discover public buckets in seconds.
Even with great IR and resiliency plans, a plaintext backup exposed to the public web is a risk you can’t talk your way out of.
What ‘Advanced Encryption’ Means: Database Encryption In Use
Encrypting at rest and in transit has proven to be largely ineffective where the data is actively in use. In the EY situation as referenced within The Register article, data was unencrypted only for a very brief time, and for a very common data usage process. That brief window of plaintext exposure was all the threat-actors needed. Plaintext must be removed from data-flow operations. When referring to advanced encryption, the word “ADVANCED” means adding encryption-in-use, or searchable encryption (Paperclip SAFE overview) so the database stores only ciphertext and privacy-preserving indexes and never stores cleartext, or plaintext within database tables and processing operations. Yes, encrypt all backups as well, but don’t rely on the backups to fix plaintext data already sitting within active tables.
Additional resources: New 2025 SAFE whitepaper, SAFE FAQs, IDC Spotlight on searchable encryption.
Enter Paperclip SAFE: Database Security that Maintains Performance Through Searchable Encryption
Applications write through SAFE’s API; data is shredded, salted, hashed, encrypted, and indexed for search. The database and its backups hold ciphertext plus encrypted indexes. Keys stay out-of-band. Operations keep their SLAs. SAFE is Advanced Encryption, keeping all critical data encrypted at rest, in transit and IN USE. Learn more: SAFE overview
Cloud Security Misconfigurations: The #1 Cause of Data Breaches
This breach wasn’t a “wow, that is new” moment. This happens all the time, and may be happening right now, in your organization. If a Big Four shop can expose a 4-TB backup, so can anyone. External scans regularly uncover public buckets and unauthenticated databases. Censys’ recurring State of the Internet research highlights routine exposure of database files and backups at internet scale. Censys: 2025 notable incidents Historical measurements have shown thousands of unauthenticated database files and backup artifacts reachable over HTTP. Here’s an example analysis.
Misconfiguration and human error are a stubborn root cause across cloud estates. Industry research consistently flags misconfig as a leading contributor to incidents. For instance, SentinelOne’s roundup attributes roughly a quarter of cloud incidents to misconfigurations, a theme echoed in conference briefs. RSA Conference blog Orca’s 2025 State of Cloud Security shows how over-privileged service accounts and exposed repos amplify that blast radius. Orca 2025 report (PDF)
How AI Increases Database Security Risks Without Encryption In Use
In addition to common processes that often expose plaintext data, two new trends are colliding with our often outdated, or legacy data discipline: rapid AI adoption and automation with broad permissions.
The short version: AI accelerates mistakes and scales exfiltration. Read on for more detail: SAFE for AI & LLMs.
- Shadow AI and weak controls. IBM’s 2025 study calls out an “AI oversight gap,” noting that most orgs reporting AI-related incidents lacked proper AI access controls and governance. IBM Cost of a Data Breach 2025
- Excessive agency. Agentic automations can create temporary staging areas, export snapshots for RAG pipelines, or spin up IaC that defaults to public. OWASP’s GenAI Top 10 spotlights risks like sensitive-information disclosure and excessive agency. OWASP LLM Top 10 (2025)
- Policy drift at machine speed. LLM-assisted coding can stamp out misconfigured buckets and permissive roles faster than code review cycles catch them. NIST’s Generative AI profile and emerging control overlays reinforce the need for AI-specific governance. NIST AI Risk Management: Generative AI profile (PDF)
How Encryption-In-Use Prevents SQL Server Backup Breaches
- The leaked “.BAK” is inert. It’s ciphertext and encrypted indexes, not readable rows.
- Secrets in tables are cryptographically protected; vault-managed tokens can’t be replayed.
- Public ACLs become audit findings, not breach notifications.
- Keys live out-of-band; DBA workflows continue without decryption rights.
- Reporting uses encrypted indexes; plaintext sidecars disappear.
Database Encryption Best Practices: an Implementation Roadmap for CISOs
- Classify and prioritize sensitive columns (PII, auth artifacts, financials). Note: Database tables already supporting critical applications are neatly structured and organized. They’re also the most valuable to threat-actors, making those tables the prime target for SAFE advanced encryption.
- Integrate at the application edge so data lands encrypted and indexed. Build a secure-by-design data workflow from the application edge through the database layer, backups and archives. Check out SAFE Archives to learn more.
- Apply and mandate advanced encryption protocols across backups and archives. Threat-actors often target backups and archives to undermine resiliency plans.
- Separate keys and duties; owners control keys, operators run platforms. SAFE employs a data owner and data holder, dual key schema.
- Retire plaintext sidecars and ad-hoc exports. Work only with encrypted data. Even the smallest gaps will be exploited.
- Continuously scan for exposure across buckets, snapshots, and pipelines. Paperclip partners with companies like Flying Cloud (Home – Flying Cloud), and Akitra (Compliance Automation Solution | SOC 2, PCI DSS, HIPAA | Akitra).
The easiest way to reduce a breach is to encrypt the data. No plaintext, no exposure, no risk.
Here’s the full guide on how to Implement encryption-in-use (searchable encryption).
Governance, Disclosures, and the Board conversation: How Encryption-In-Use Reduces Compliance Risk
When production stores and backups never hold plaintext, most exposures downgrade from “data breach” to “control failure.” That materially shifts disclosure posture and strengthens your hand under GDPR, HIPAA, PCI DSS 4.0, NYDFS 500, and DORA. Here’s a quick reference for compliance (2025).
Bottom line: remove plaintext from databases and backups, so even your worst bucket day is an audit lesson, not frontpage news.
Implement Advanced Database Encryption Before Your Next Breach
Stop letting plaintext decide your risk. If a 4-TB backup can slip at a Big Four, it can slip anywhere. The only durable fix is to remove plaintext from production and backups. Paperclip SAFE delivers encryption-in-use now: searchable ciphertext in your database, keys out-of-band, no break to backup/restore, and no “temporary” CSVs orbiting your cloud.
- For CISOs: turn inevitable misconfigurations into control findings, not breaches. Harden your GDPR/PCI/NYDFS/SEC/DORA posture; gain confidence in data privacy, security, and compliance.
- For DBAs: keep SLAs and tooling, protect the columns that matter first, make data more usable while increasing security, retire plaintext sidecars without slowing queries.
- For Purchasing: Advanced encryption at a price comparable to legacy encryption, delivered through a software-only deployment with fast time-to-value and predictable TCO—without specialized hardware. Teams can explore SAFE deployment options to align security with operational and budget requirements.
Act before your next backup does.
Book a live demo, and get pricing locked this quarter. Encrypt in use, make stolen files boring, and end the plaintext era today. Contact Paperclip – Paperclip Data Management & Security to learn more.
Frequently Asked Questions About Database Encryption and Breach Prevention
Q: Should database backups be encrypted?
A: Yes, database backups must be encrypted—but encrypting backups alone is insufficient. The EY breach demonstrated that even with backup encryption capabilities available, misconfigurations can expose unencrypted backup files. True database security requires encryption-in-use, where data remains encrypted throughout its entire lifecycle, including in active database tables, backups, and archives.
Q: What is the number one cause of data breaches?
A: Cloud security misconfigurations are consistently identified as a leading cause of data breaches. Research from SentinelOne and Orca Security shows that roughly 25% of cloud incidents stem from misconfigurations like exposed storage buckets, overly permissive access controls, and unencrypted backups. When databases store plaintext data, any misconfiguration becomes a potential breach.
Q: What is encryption in use, and how is it different from TDE?
A: Encryption-in-use (also called searchable encryption) keeps data encrypted at all times—at rest, in transit, and during active processing. Unlike Transparent Data Encryption (TDE), which only encrypts data on disk and creates plaintext during queries, encryption-in-use maintains data in encrypted form even within active database tables. This means backups, exports, and database operations all work with ciphertext, eliminating plaintext exposure risks.
Q: How do cloud misconfigurations lead to data breaches?
A: Cloud misconfigurations create unintended data exposure through mistakes like public storage bucket permissions, unauthenticated database endpoints, or backup files accessible via the internet. Automated scanners constantly search for these vulnerabilities. When databases contain plaintext data, a single misconfiguration can expose millions of records. Encryption-in-use limits breach impact by ensuring that even exposed files contain only encrypted data.
Q: What is the difference between TDE and backup encryption?
A: TDE (Transparent Data Encryption) encrypts database files on disk and backups automatically but creates plaintext during active queries and application operations. Backup encryption specifically protects backup files but leaves data unencrypted in active database tables. Neither protects data during processing. Encryption-in-use maintains data in encrypted form throughout all operations, protecting against exposure during processing, temporary exports, and backups.
Q: How can companies prevent data breaches like the EY incident?
A: Preventing breaches like the EY SQL Server backup exposure requires layered security: (1) Implement encryption-in-use so databases never store plaintext, (2) Continuously scan for cloud misconfigurations and exposed resources, (3) Apply least-privilege access controls and separate encryption key management from data operations, (4) Encrypt all backups and archives separately, and (5) Implement data loss prevention monitoring for unauthorized exports.
Q: What are database security best practices for 2025?
A: Modern database security best practices include: implementing encryption-in-use for sensitive data columns, maintaining separation between key management and database operations, continuously monitoring for cloud misconfigurations, applying zero-trust access controls, encrypting all backups and archives, eliminating plaintext exports and temporary files, and implementing AI-specific governance for automated data processing workflows.
Q: Does encryption-in-use impact database performance?
A: Modern searchable encryption technology like Paperclip SAFE is designed to maintain database performance through encrypted indexing. Unlike full homomorphic encryption, searchable encryption uses cryptographically protected indexes that enable queries, sorting, and joins directly on encrypted data without decryption. This preserves SLAs while eliminating plaintext exposure, making it practical for production enterprise databases.