Insecure Hadoop Distributed File System installs 5 PB of Data

According to Shodan search, unprotected Hadoop Distributed File System installations expose 5 PB of data.

Hadoop servers that are not securely configured expose vast amounts of data, according to an analysis conducted using the Internet search engine Shodan.

A study conducted by Shodan revealed that nearly 4,500 servers with the Hadoop Distributed File System (HDFS) were found to expose 5,120 TB (5.12 PB) of data.

The overall volume of data exposed by HDFS system is greater than the one related to MongoDB installs.

“However, in terms of data volume it turns out that HDFS is the real juggernaut.” reads the analysis published by Shodan. “To give you a better idea here’s a quick comparison between MongoDB and HDFS:”

  MongoDB HDFS
Number of Servers 47,820 4,487
Data Exposed 25 TB 5,120 TB

“Even though there are more MongoDB databases connected to the Internet without authentication in terms of data exposure it is dwarfed by HDFS clusters (25 TB vs 5 PB).”

Most of the servers with the Hadoop Distributed File System are located in the United States (1,900) and China (1,426), followed by Germany and South Korea with 129 and 115 servers, respectively.


The majority of the HDFS install are hosted in the cloud, mainly Amazon (1,059 instances) and Alibaba (507).

In 2016, security experts observed ransom attacks aimed at unsecured MongoDB database installs exposed online.

According to the researchers, the hackers were implementing an extortion mechanism copying and deleting data from vulnerable databases.

Crooks requested the payment of a ransom in order to return data and help the company to fix the flaw they exploited.

Similar ransom attacks later began targeting ElasticsearchCouchDB and Hadoop servers, such kind of attacks still target Hadoop and MongoDB installations.

According to Shodan founder John Matherly, a majority of the MongoDB servers exposed on the Internet have already been already compromised.

First attacks observed by the experts targeting HDFS installs erased most directories and created a directory named “NODATA4U_SECUREYOURSHIT.”  No ransom was asked for from the victims.

Querying Shodan for “NODATA4U_SECUREYOURSHIT” string, the popular search engine retrieves more than 200 Hadoop Distributed File System installs.

The blog post published by Shodan includes instructions on how to search Hadoop Distributed File System installs exposed online.

FAIR USE NOTICE: Under the "fair use" act, another author may make limited use of the original author's work without asking permission. Pursuant to 17 U.S. Code § 107, certain uses of copyrighted material "for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright." As a matter of policy, fair use is based on the belief that the public is entitled to freely use portions of copyrighted materials for purposes of commentary and criticism. The fair use privilege is perhaps the most significant limitation on a copyright owner's exclusive rights. Cyber Defense Media Group is a news reporting company, reporting cyber news, events, information and much more at no charge at our website Cyber Defense Magazine. All images and reporting are done exclusively under the Fair Use of the US copyright act.

Global InfoSec Awards 2022

We are in our 10th year, and these awards are incredibly well received – helping build buzz, customer awareness, sales and marketing growth opportunities, investment opportunities and so much more.


10th Anniversary Exclusive Top 100 CISO Conference & Innovators Showcase