Rwanda Rural Rehabilitation Initiative (RWARRI): 14,000 files exposed in Bucket (S3)

Reviewing my old notes and checking if the issue was still present, I sent a responsible disclosure last year to:

The Rwanda Rural Rehabilitation Initiative (RWARRI) is a Rwandan non-governmental organization (NGO) dedicated to improving the social and economic well-being of rural communities.


At that time, an S3 bucket containing at least 14,000 files was exposed. Therefore, I sent an email to the organization explaining the situation: ID cards, vouchers, letters, invoices, etc.


You can see in the sample a file of an attendance sheet for a meeting of an agricultural project in Rwanda, that sheet contained personal data such as names and surnames, Rwandan national identity card number, Sex, Telephone, Organization, signature.
an example of the files exposed by this entity


You can see in the sample a file of an attendance sheet for a meeting of an agricultural project in Rwanda, that sheet contained personal data such as names and surnames, Rwandan national identity card number, Sex, Telephone, Organization, signature.


According to my records, this was sent on November 25, 2024. I also attached the email to the National Cyber ​​Security Authority of Rwanda (ncsa.gov.rw).


*Today, access to the bucket is denied, this was closed in April of this year, according to my notes., I received no response from either entity.