Incident BriefingsCottonWorks public-database exposure

CottonWorks public-database exposure

Cotton Incorporated said a CottonWorks.com database export was inadvertently made public during a hosting-provider migration.

Last modified

Summary

  • Environment: CottonWorks.com website database migration
  • Operational impact: Registration data and plaintext passwords publicly exposed
  • Financial impact: No incident cost disclosed
  • Record status: Developing record. Reviewed November 4, 2026; updated as evidence emerges.

What happened

Cotton Incorporated said a CottonWorks.com database export was inadvertently made public during a hosting-provider migration. [1]

Impact

The company believed unknown parties downloaded the export four times between September 18 and October 15, 2026. It reported no evidence of subsequent use. [1]

The export could include names, emails, employer or school affiliation, addresses, user-supplied biographies and plaintext passwords. [1]

Timeline

  1. Briefing updated

    This briefing was last reviewed and updated on November 4, 2026.

Threat Group & Attack Vector

The disclosure describes an accidentally public export, rather than establishing exploitation of a software vulnerability. [1]

Actors

  • The disclosure attributes this incident to an error; it does not identify a threat actor group.

TTPs

  • No specific MITRE ATT&CK technique is currently mapped for this case.

Response

Cotton disabled access, removed cleartext passwords, required password changes and began reviewing security practices and hosting arrangements. It advised changing reused passwords elsewhere. [1]