In September 2014, Mozilla disclosed that backups from a test instance of its Bugzilla defect-tracking system had been placed in a publicly accessible location. The backups remained exposed for approximately three months before discovery and contained information belonging to about 97,000 users, including email addresses and hashed passwords. The incident resulted from an infrastructure and access-control failure rather than a deliberate data-release program.
Mozilla said the use of a test system limited the security risk, but the exposure still created opportunities for credential attacks, particularly where users had reused passwords on other services. The organization reset the affected Bugzilla passwords and advised users to change reused credentials elsewhere. The disclosure demonstrated that development and testing environments could expose production-like account data even when the primary service had not been directly breached.
