Sears Home Services AI chatbot databases expose millions of customer records
A security researcher discovered three unsecured databases containing sensitive customer information tied to Sears Home Services’ AI assistant, exposing chat logs and audio recordings.
Three publicly accessible databases exposed millions of AI chat logs and audio recordings without any authentication.
Key facts
- What
- A security researcher discovered three unsecured databases containing sensitive customer information tied to Sears Home Services’ AI assistant, exposing chat logs and audio recordings.
- Incident date
- Mar 18, 2026
- Who
- Sears Home Services
- Failure mode
- Data Leakage
- AI surface
- Chatbot
- Severity
- High
What happened
A security researcher found three unsecured databases containing sensitive customer information tied to Sears Home Services’ AI assistant. The leak included 3.7 million chat logs and 1.4 million audio recordings, with exposed scheduling conversations and contact details.
What broke inside the model
- 01 · TriggerA request triggers retrieval or context loading.
- 02 · Model stepThe context pulls in another user's content.
- 03 · Control gapNo boundary enforces isolation at the moment of output.
- 04 · FailurePrivate data crosses into the response.
- 05 · ConsequenceOne user sees another's data, and disclosure follows.
One user's content crosses the retrieval boundary into another's response.
The mechanism was a critical infrastructure misconfiguration where the databases storing AI interaction logs were left publicly accessible. No authentication was required, allowing millions of private records to be exposed on the open web.
What it cost
Sources
Cite this entry
https://failureindex.ai/failures/sears-home-services-chatbot-databases-exposeAI Failure Index. "Sears Home Services AI chatbot databases expose millions of customer records" (FI-0218). Realm Labs. https://failureindex.ai/failures/sears-home-services-chatbot-databases-expose (indexed Jun 5, 2026).Data fields CC-BY 4.0, prose citation permitted. Incident ID FI-0218. Full dataset at /data.
Note from Realm Labs, the Index steward
How Realm would have caught this
- Prism
- OmniGuard
- AI Detection & Response (AIDR)
Realm can detect when a response is about to emit data that falls outside the bounds of the current user and context, and block or redact it inline, at the moment of generation rather than after the data has left.