Breaches · 50 days ago
BleepingComputer reports that more than 9,300 Amazon Web Services access keys publicly exposed between August 2022 and August 2026 are still active and valid. The finding turns an old leak into a live access problem: keys that should have died with the incident are still able to reach corporate AWS accounts.
An exposed AWS access key works like a standing password for cloud APIs. If it is still enabled and still has privileges, anyone who finds it can create resources, read data, or move deeper into the account until the key is disabled.
For teams that store credentials in code, tickets, paste sites, or public repos, the lasting exposure is not the disclosure date but whether the key was ever revoked. A leak can remain an operational admin path long after the original mistake and long after people or projects have changed.
2 sources covering this story
Researchers Uncover Thousands of Leaked AWS Keys
Truffle Security says it found over 9000 publicly accessible and active AWS key pairs
Hundreds of leaked AWS keys give full control over corporate accounts
More than 9,300 Amazon Web Services (AWS) access keys publicly exposed between August 2022 and August 2026 are still active and valid.
Part of the PlainSec briefing for 2026-08-25