CyphrQ
Menu

DeepSeek Data Leak: What Wiz Found and How Regulators Reacted

In January 2025 Wiz found an open DeepSeek database with over 1 million log entries. What was exposed, what regulators did, and what IT teams should check.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

Incident: January 202510 min read

What was the DeepSeek data leak? In January 2025, security firm Wiz Research found a database belonging to the Chinese AI company DeepSeek that was open to the internet with no password. It held over 1 million log lines, including chat history and API keys. DeepSeek secured it quickly after Wiz reported it. Wiz does not say whether anyone else got in.

This is a case file. It keeps two things apart that news coverage often blurs: the security exposure Wiz found, and the separate privacy action by regulators. It ends with what to check before your own team uses an AI app.

Case file

Field Value
Organisation DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and Beijing DeepSeek Artificial Intelligence Co., Ltd. are the two companies the Italian regulator named)
Region China-based company; regulator action in Italy and South Korea
Exposure reported 29 January 2025, by Wiz Research (Wiz)
What was exposed A ClickHouse database described as "completely open and unauthenticated" (Wiz)
Data types Over 1 million log entries from 6 January 2025, with chat history, API keys, backend details and operational metadata (Wiz)
People affected Not stated in the Wiz post
Misuse Wiz's post makes no statement on whether anyone else accessed the data
Regulator actions Italy's Garante, 30 January 2025 (Garante); South Korea's PIPC, February 2025 (PIPC)
Status Exposure closed per Wiz. Regulatory outcomes after early 2025 not checked for this post

What did Wiz find in DeepSeek's exposed database?

Wiz Research said it found a publicly accessible ClickHouse database belonging to DeepSeek. ClickHouse is a database built for storing and querying very large volumes of log and event data. Wiz described the database as "completely open and unauthenticated" (Wiz).

How Wiz found it is ordinary reconnaissance. It mapped about 30 DeepSeek subdomains, then looked past the usual web ports (80 and 443) for other services answering on the internet. Two hosts, oauth2callback.deepseek.com and dev.deepseek.com, were answering on ports 9000 and 8123 (Wiz).

Through the database's web interface at /play, Wiz could run SQL queries. Listing the tables showed what was there. Wiz says it did not run intrusive queries beyond enumeration.

Nobody broke in. The door was open. That is what makes this kind of exposure both common and avoidable.

What data was in the DeepSeek database?

The main table, log_stream, held "over 1 million log entries" dating from 6 January 2025. Wiz reports that the logs contained:

  • chat history
  • API keys (secret tokens a program uses to prove it is allowed to call a service)
  • backend details, including directory structures
  • operational metadata about the chatbot

(Wiz)

Wiz also says that, depending on how the server was configured, an attacker might have been able to pull plaintext passwords and local files out with the database's file functions. That is Wiz's assessment of what was possible. Wiz does not say it did this or that anyone else did.

Here is what the Wiz post does not say, so I don't either:

  • how many users' conversations were in the logs
  • how long the database had been open
  • whether anyone other than Wiz accessed it

If you see a figure for any of those in the press, it did not come from this post.

How did DeepSeek respond to the Wiz report?

Wiz says it "immediately and responsibly disclosed the issue to DeepSeek." Wiz says DeepSeek "promptly secured the exposure" (Wiz). I found no public DeepSeek statement or incident report on the exposure, so the Wiz post is the only account of how it was closed.

What did Italy's regulator do about DeepSeek?

This is a separate matter from the exposed database. The Garante, Italy's data protection authority, acted on privacy grounds in an order dated 30 January 2025, the day after Wiz's post (Garante).

What the order says, in outline:

  • Who: Hangzhou DeepSeek and Beijing DeepSeek, named as data controllers.
  • What: a "limitazione definitiva", a definitive limitation, of the processing of personal data of people located in Italy, under Article 58(2)(f) of the GDPR. It took effect on receipt and left room for further decisions once the investigation ends.
  • Steps before it: the Garante sent an information request on 28 January 2025. The companies replied on 29 January that they had not entered and did not plan to enter the Italian market, that they had removed the app from local app stores, and that the GDPR did not apply to them.
  • Why the Garante disagreed: it applied Article 3(2)(a) GDPR, which covers companies that offer services to people in the EU. It found, among other things, that the privacy policy was available only in English, that it did not specify the lawful basis for each processing activity, that data were reportedly stored in China, and that no representative had been designated in writing in the EU (Article 27).

Does the order mention the Wiz finding? In the reasons I read, it does not. The Garante's grounds are about transparency, legal basis, storage location and representation. Treat the two events as parallel, not as cause and effect.

What did South Korea's regulator do about DeepSeek?

South Korea's Personal Information Protection Commission (PIPC) issued a press release dated 17 February 2025. It says DeepSeek temporarily suspended its service in Korea from 15 February 2025 and removed its app from Apple's App Store and Google Play (PIPC).

Note the wording. The PIPC says it recommended the temporary suspension, and DeepSeek agreed. It was not a fine or a formal order.

The PIPC's reasons:

  • its analysis found traffic from third-party data transfers
  • the privacy policy was not transparent enough
  • DeepSeek itself acknowledged it had "failed to take into account meeting the legal requirements pursuant to the PIPA" when it launched globally

The release adds that existing users could keep using the service, and the PIPC "urges users to exercise caution and avoid entering personal information into the chatbot" until its examination is complete. Like the Italian order, it does not rest on the Wiz finding in the reasons I read.

I did not find the PIPC's later decisions on its own site, so I do not report how the matter ended.

What did US authorities do about DeepSeek?

At state level, the Texas Governor's office announced a ban on DeepSeek and five other apps on government-issued devices in January 2025. State agencies were told to bar them, and the Department of Public Safety and the Department of Information Resources were directed to add them to Texas's prohibited technologies list, which covers state employees and contractors on state-owned or personal devices used for work (Texas Governor). The stated reason is national security and data-harvesting concerns, not the Wiz finding.

I did not read primary pages for federal agency actions, so this post makes no claim about them.

What is established and what is not about the DeepSeek exposure?

Question Status as of 25 October 2026
Was a DeepSeek database exposed with no authentication? Reported by Wiz, which says DeepSeek secured it
What was in it? Over 1 million log entries including chat history and API keys, per Wiz
Did anyone else access it? Not stated by Wiz. I make no claim
Did regulators cite the exposure? Not in the reasons I read from the Garante or the PIPC
Final outcome of the Italian investigation Not checked
Final outcome of the Korean review Not checked

Going deeper: for security and IT teams

Threat model. The attacker here is anyone running an internet scan. What they need is a hostname and a port. What they get, per Wiz, is an unauthenticated SQL interface over a table of plaintext logs. Logs are the dangerous part: they collect whatever the application printed, which can include prompts, replies and secrets.

Exposed database discovery. Wiz's method was subdomain enumeration followed by checking non-web ports (Wiz). Run the same exercise against yourself before someone else does:

  • List every subdomain, including dev, test and OAuth callback hosts. Those two hostnames are the ones Wiz named.
  • Scan your external ranges for database ports, not only 80 and 443. Wiz found services on 9000 and 8123.
  • Compare the result with your asset inventory. Anything open that nobody owns is the finding.

MITRE ATT&CK lists T1190 Exploit Public-Facing Application under Initial Access (TA0001) as the closest entry for a service exposed to the internet. No exploit was needed in this case, but its mitigations apply. They include M1035 Limit Access to Resource Over Network ("Ensure that all publicly exposed services are actually intended to be so"), M1030 Network Segmentation, and M1037 Filter Network Traffic.

Network exposure controls. For ClickHouse specifically, the vendor documents a networks setting per user: a list of networks from which that user can connect. It accepts <ip>, <host> and <host_regexp> entries. ClickHouse warns that <ip>::/0 opens access from any network and is insecure unless a firewall is properly configured or the server is not directly connected to the internet (ClickHouse docs). Also check the user's password settings. The documentation labels a plaintext password as "not recommended" and offers password_sha256_hex. Beyond the product settings, the generic fix is the same for any datastore: no public IP, a private subnet, and access only through a VPN or a bastion with MFA.

Logging data in AI products. An AI product's logs are a second copy of its users' conversations. Ask:

  • Do application logs record full prompts and responses, or only metadata such as request ID, latency and token counts?
  • Are API keys, tokens and session cookies masked before they reach the log pipeline?
  • Is the log store encrypted, access-controlled and given a retention limit measured in days, not "forever"?
  • Is access to the log store itself logged and alerted on?

Wiz's finding is that this log table held chat history and API keys in plaintext. That is exactly the case these questions are written for.

Vendor due diligence for AI apps. The regulator actions show what a regulator looks for, and you can borrow the list. From the Garante's order: where is data stored, is there a privacy policy in the language of your users, does it state a lawful basis for each processing activity, is there a designated representative where the GDPR applies (Garante). From the PIPC: does the app send data to third parties, and is the privacy policy clear about it (PIPC). Add the security basics: ask for a recent penetration test summary, an independent certification such as ISO/IEC 27001, and the vendor's vulnerability disclosure process. A vendor with a disclosure process is one that can fix a report like Wiz's quickly.

Detection and evidence. If your staff may have used an AI app that later reports an exposure:

  • check proxy or DNS logs for the app's domains to see who used it and when
  • review your CASB or endpoint tool for the app's sign-ins
  • rotate any API key or token that was pasted into a prompt, because logs may have kept it

What should you check before using DeepSeek or any AI app at work?

  1. Find out whether anyone in your organisation already uses it. You cannot assess an app you don't know about.
  2. Decide what may never go in: customer data, credentials, API keys, unreleased financials.
  3. Read the vendor's privacy policy for where data is stored, who it is shared with and how long it is kept.
  4. Check whether your sector or your government customers restrict it. Texas, for one, put DeepSeek on its prohibited technologies list.
  5. Scan your own external footprint for databases and dashboards that nobody meant to publish.

Key takeaways

  • Wiz Research reported on 29 January 2025 a DeepSeek ClickHouse database that was open with no authentication, containing over 1 million log entries with chat history and API keys.
  • Wiz says it disclosed the issue and DeepSeek promptly secured it. Wiz makes no statement on whether anyone else accessed the data, so I make no claim of misuse.
  • Italy's Garante ordered a definitive limitation of processing of Italian users' data on 30 January 2025, on privacy grounds such as transparency, legal basis and EU representation.
  • South Korea's PIPC recommended a temporary suspension, which DeepSeek accepted from 15 February 2025, citing third-party data transfers and an unclear privacy policy.
  • In the reasons I read, neither regulator cites the Wiz finding. The exposure and the regulatory action are two separate stories.
  • The cheapest lessons: know what you expose to the internet, keep secrets and chats out of plaintext logs, and ask AI vendors where your data goes.

Sources