DeepSeek security breach - critical databases exposed, more than one million records reportedly leaked

A person using DeepSeek on their smartphone

(Image credit: Adobe Stock)

A leaky DeepSeek database was discovered by researchers
The database allowed for total operation control takeover
An attacker could extract passwords, chat logs, and more

Not long after emerging onto the AI scene and significantly disrupting the US tech markets, a leaky DeepSeek database has reportedly been discovered online.

The ClickHouse database that belongs to DeepSeek was found by Wiz cybersecurity researchers, and allowed for full database operations controls.

The database has since been secured, but the researchers warn it could have exposed chat history, secret keys, backend details, log streams, API Secrets, and operational details.

DeepLeak

The leaky database was apparently found within minutes of Wiz beginning its research, with the researchers noting that if exploited, the database operations would allow an attacker to escalate privileges within the DeepSeek environment.

The vulnerability was discovered after two open ports were found that lead directly to the ClickHouse database without any authentication checks. Upon further investigation, the researchers discovered they were able to run commands in the HTTP interface to access over 1 million sensitive log entries.

If abused by an attacker, the database could be exploited to access plaintext passwords, chat histories, API Keys and more. After Wiz notified the exposure to DeepSeek, the vulnerability was immediately addressed and secured.

The Wiz researchers recommend businesses looking to use and adopt AI tools into their workflow pay close attention to the security of each solution, and protect customer data from exposure when using AI platforms.

Take a look at our guide to the best endpoint protection
These are the best business VPNs
Could clever hardware hack be behind DeepSeek's groundbreaking AI efficiency?

Benedict has been writing about security issues for over 7 years, first focusing on geopolitics and international relations while at the University of Buckingham. During this time he studied BA Politics with Journalism, for which he received a second-class honours (upper division), then continuing his studies at a postgraduate level, achieving a distinction in MA Security, Intelligence and Diplomacy. Upon joining TechRadar Pro as a Staff Writer, Benedict transitioned his focus towards cybersecurity, exploring state-sponsored threat actors, malware, social engineering, and national security. Benedict is also an expert on B2B security products, including firewalls, antivirus, endpoint security, and password management.