Blog / OneDrive Security Breach Shows: Why Zero-Knowledge Matters

In May 2025, the Oasis Security published an analysis that caused a stir in the cloud world: a vulnerability in OneDrive File Picker allowed third-party applications to access files for which they did not actually have access rights. Millions of users were affected, both private individuals and companies.

What exactly happened, why is this incident so explosive, and what can you learn from it to better protect your own data?

What Went Wrong With OneDrive File Picker?

OneDrive File Picker is a popular interface that allows apps to access files from personal cloud storage. However, Oasis Security discovered that certain configuration errors allowed applications to view and download files that they did not officially have access to – even sensitive content such as tax documents, project plans, or confidential meeting minutes.

Worse still, the affected applications did not even need to use an exploit – all they had to do was use the File Picker correctly (or rather, incorrectly). The problem was not a targeted hack, but a design flaw in the system.

The Real Lesson: Trust Is Not a Security Concept

Many users trust cloud providers such as Microsoft, Google, and Apple to keep their data secure. But this incident shows that even large platforms make mistakes—with far-reaching consequences.

The real problem runs deeper:

• Access rights are managed in the backend, not by the user(s) themselves.
• Files are often stored unencrypted on servers—or only with a key that the provider itself controls.
• Security vulnerabilities in third-party apps or web interfaces can be exploited without those affected even noticing.

In short: anyone who entrusts their data exclusively to the security promises of cloud providers is relinquishing control.

The Solution: Zero-Knowledge Encryption With Cryptomator

Cryptomator takes a fundamentally different approach: files are encrypted locally on your device before being uploaded to the cloud. This means your data remains protected even if the cloud provider is compromised—or, as in the case of OneDrive, simply makes a mistake.

This means:

• No one but you can read your files—not Microsoft, not Google, not us.
• Access rights are secondary, because without the key, all data remains unreadable.
• Even compromised APIs or third-party apps only see encrypted garbage data.

Cryptomator Hub offers the ideal extension for teams, organizations, and companies:

• Centralized management of encrypted vaults
  IT administrators can preconfigure vaults and share them with specific users—all with end-to-end encryption.
• Role-based access control
  Thanks to the role-based system, you can specify exactly who is allowed to create, open, or manage vaults—without central key distribution.
• Web of trust for secure collaboration
  Team members verify each other, creating a trustworthy environment—without the need for external certificate authorities.
• Seamless integration into existing cloud workflows
  Cryptomator Hub can be easily combined with existing cloud storage solutions such as OneDrive, Google Drive, or Dropbox.

Cryptomator Hub enables highly secure and practical cloud usage within teams without the usual compromises in data protection and compliance. This is a future-proof solution, especially for organizations with increased requirements, such as NGOs, research institutions, or companies in regulated industries.

What You Can Do Now

Whether you use OneDrive, Dropbox, or another cloud service, this incident shows that no provider can offer 100% security on its own. However, you can drastically reduce your risks by taking a few simple steps:

• Use client-side encryption with tools such as Cryptomator.
• Do not store particularly sensitive documents unencrypted in the cloud.
• Raise awareness among your team members or colleagues about cloud access rights.
• Check which third-party apps have access to your cloud.

Conclusion: Safety Begins With Control

The OneDrive security breach is not an isolated incident—it is a symptom of a system that relies on trust rather than real control. But if you encrypt your files before uploading them, you remain protected even in the event of serious security breaches.

With Cryptomator, you retain full control over your data, your privacy, and your digital security.