---
title: "CottonWorks public-database exposure"
description: "Cotton Incorporated said a CottonWorks.com database export was inadvertently made public during a hosting-provider migration."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-04"
canonical_url: "https://www.ally.security/incidents/cottonworks-public-database-exposure-2026"
markdown_url: "https://www.ally.security/incidents/cottonworks-public-database-exposure-2026.md"
stix_url: "https://www.ally.security/incidents/cottonworks-public-database-exposure-2026/stix.json"
---

# CottonWorks public-database exposure

Cotton Incorporated said a CottonWorks.com database export was inadvertently made public during a hosting-provider migration.

Last modified Nov 4, 2026 · 1 source

## Summary

- **Environment:** CottonWorks.com website database migration
- **Operational impact:** Registration data and plaintext passwords publicly exposed
- **Financial impact:** No incident cost disclosed

## What happened

[Cotton Incorporated](https://www.cottoninc.com/) said a [CottonWorks.com](https://cottonworks.com/) database export was inadvertently made public during a hosting-provider migration. [1](#source-1)

## Impact

The company believed unknown parties downloaded the export four times between September 18 and October 15, 2026. It reported no evidence of subsequent use. [1](#source-1)

The export could include names, emails, employer or school affiliation, addresses, user-supplied biographies and plaintext passwords. [1](#source-1)

## Timeline

### November 4, 2026 — Briefing updated

This briefing was last reviewed and updated on November 4, 2026.

## Threat Group & Attack Vector

The disclosure describes an accidentally public export, rather than establishing exploitation of a software vulnerability. [1](#source-1)

### Actors

- The disclosure attributes this incident to an error; it does not identify a threat actor group.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

Cotton disabled access, removed cleartext passwords, required password changes and began reviewing security practices and hosting arrangements. It advised changing reused passwords elsewhere. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/cottonworks-public-database-exposure-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Cotton Incorporated data security notice

official · Cotton Incorporated

<https://oag.ca.gov/system/files/Data%20Breach%20Notice_0.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   CottonWorks public-database exposure: Cotton Incorporated said a CottonWorks.com database export was inadvertently made public during a hosting-provider migration.
2. **Resulted In · 100% confidence · current**  
   CottonWorks public-database exposure: Cotton disabled access, removed cleartext passwords, required password changes and began reviewing security practices and hosting arrangements. It advised changing reused passwords elsewhere.
3. **Resulted In · 100% confidence · current**  
   CottonWorks public-database exposure: The export could include names, emails, employer or school affiliation, addresses, user-supplied biographies and plaintext passwords.
4. **Resulted In · 100% confidence · current**  
   CottonWorks public-database exposure: The disclosure describes an accidentally public export, rather than establishing exploitation of a software vulnerability.
5. **Affected Organization · 100% confidence · current**  
   CottonWorks public-database exposure: Cotton Incorporated
6. **Resulted In · 100% confidence · current**  
   CottonWorks public-database exposure: The company believed unknown parties downloaded the export four times between September 18 and October 15, 2026. It reported no evidence of subsequent use.

</details>