Full Report
More than 9,300 Amazon Web Services (AWS) access keys publicly exposed between August 2022 and August 2026 are still active and valid. [...]
Analysis Summary
# Incident Report: Massive Persistent Exposure of AWS Access Keys (2022-2026)
## Executive Summary
A four-year longitudinal study by Truffle Security revealed that over 9,300 AWS access keys publicly leaked between 2022 and 2026 remain active and valid. Hundreds of these keys grant "full control" over corporate environments, including root-level access and AdministratorAccess IAM policies. The findings highlight a critical failure in credential rotation and incident response across thousands of organizations, particularly within AI development platforms.
## Incident Details
- **Discovery Date:** Findings published August 21, 2026 (Tracking since 2022)
- **Incident Date:** Ongoing exposure from August 2022 – August 2026
- **Affected Organization:** 50,654 AWS accounts impacted; major source identified as Hugging Face (8,482 keys)
- **Sector:** Technology, AI/ML Development, Cloud Services
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** August 2022 to August 2026 (Continuous)
- **Vector:** Public Leaks via Code Repositories and Infrastructure Logs
- **Details:** AWS secrets were committed to public platforms including GitHub (Git history), Hugging Face datasets, Docker images/registries, and Continuous Integration (CI) logs.
### Lateral Movement
- **Details:** While the report focuses on exposure, the possession of **Root Keys** (526 identified) and **AdministratorAccess** keys (242 identified) bypasses the need for traditional lateral movement, granting immediate, unrestricted access to the entire AWS organization.
### Data Exfiltration/Impact
- **Details:** Potential for total data wipes, exfiltration of cloud-hosted databases, and takeover of server instances. High risk of financial impact via unauthorized cryptomining.
### Detection & Response
- **Detection:** Discovered by Truffle Security through automated scanning of 431,875 secrets.
- **Response:** Researchers verified 10,616 keys; 88% remained valid. Notified identifiable owners of the credentials. Only 398 instances showed evidence of key rotation.
## Attack Methodology
- **Initial Access:** Exploitation of leaked credentials in public domains (Hugging Face, GitHub).
- **Persistence:** Creation of rogue admin accounts (potential); long-lived keys (median age 5 years).
- **Privilege Escalation:** Use of exposed **Root** accounts which have no IAM restrictions.
- **Defense Evasion:** Use of legitimate credentials; only 262 accounts had budget alerts to detect anomalous spending.
- **Credential Access:** Extraction from CI logs, Docker images, and Git metadata.
- **Discovery:** Automated scanning of public repositories (Scanning tools like TruffleHog).
- **Lateral Movement:** Direct access to all AWS services via high-privilege IAM roles.
- **Impact:** Potential for resource hijacking (Cryptomining) and data destruction.
## Impact Assessment
- **Financial:** Extremely high potential for "bill shock" via unauthorized resource provisioning; only 9.5% of accounts had budget alerts configured.
- **Data Breach:** Exposure of 64,024 unique AWS keys across 50,000+ accounts.
- **Operational:** Risk of complete infrastructure deletion or shutdown.
- **Reputational:** Significant brand damage for organizations (like Hugging Face) identified as primary sources of leaks.
## Indicators of Compromise
- **Network:** Access requests from anomalous IPs/Geographies to AWS APIs (hxxtps[://]sts[.]amazonaws[.]com).
- **File:** Presence of `.aws/credentials` or `AKIA...` strings in public Git commits, Docker layers, or Hugging Face datasets.
- **Behavioral:** Unauthorized creation of high-compute EC2 instances (P-series/G-series) in unused AWS regions.
## Response Actions
- **Containment:** Truffle Security notified identifiable owners of the exposed credentials.
- **Eradication:** Recommended revocation of all exposed keys and deletion of all root access keys.
- **Recovery:** Implementation of budget alerts and IAM credential reviews.
## Lessons Learned
- **Key Takeaways:** Credential exposure is often permanent if not explicitly revoked; simply deleting a file does not clear Git history or Docker layers.
- **What could have been done better:** Organizations failed to monitor public repositories for their own secrets and ignored AWS "Compromised Key" automated notifications.
## Recommendations
1. **Zero Root Policy:** Delete all AWS Root Access Keys; use IAM roles and MFA for administrative tasks.
2. **Secret Scanning:** Implement pre-commit hooks and CI/CD pipeline scanning to prevent secrets from reaching repositories.
3. **Automated Rotation:** Enforce a maximum key age (e.g., 90 days) via IAM policies.
4. **Monitoring:** Configure AWS Budgets and GuardDuty to alert on anomalous spending or credential usage.
5. **Treat Leaks as Breaches:** Any credential committed to a public source must be treated as instantly compromised and rotated immediately.