Cybersecurity — 2026-04-18

Fiverr Cloudinary exposure leaks invoices, tax returns, drivers licenses via public URLs indexed by Google

A publicly exposed Cloudinary instance tied to freelance marketplace Fiverr has been leaking user invoices, tax returns, driver's licenses, API credentials, and penetration test reports indexed by Google Search. Cybernews reported confirmation that affected URLs surface sensitive documents in standard searches. Fiverr denied the characterization as a cyber incident, saying the company does not proactively expose users' private information. An anonymous researcher said disclosure to Fiverr 40+ days ago went unanswered. Root cause is data sprawl plus public non-expiring Cloudinary URLs rather than an exploit.

Analysis
The failure pattern, data sprawl across third-party CDN infrastructure with non-expiring public URLs indexed by search engines, is structurally endemic rather than idiosyncratic to Fiverr; reported via Cybernews but contested by the company, the exposure nonetheless confirms a Cloudinary-public-URL default that affects any platform integrating rapid content delivery without URL lifecycle controls. Likely within the next 90 days, similar exposures surface at gig-economy, freelance-education, and community-document platforms sharing that architecture. Fiverr's denial is reputational, not technical: documents indexed by Google exist regardless of whether a breach occurred, and a 40-day unanswered disclosure window signals security-team unresponsiveness rather than resolved risk. Quietly deployed remediation could vindicate Fiverr's framing, in which case index-purge evidence should appear in search results within the current cycle; its absence would suggest active exposure persists.

3 sources

Massive cyber blunder at Fiverr: user IDs, private data leaking on Google Search - Cybernews
Fiverr Denies Report of Data Leak - PYMNTS
Researchers Say Fiverr Left User Files Open to Google Search - Hackread