A massive exposure of over 9,300 Amazon Web Services (AWS) access keys has been identified, with many remaining active and providing full administrative control to potential attackers.
- Over 9,300 AWS access keys were exposed between 2022 and 2026.
- 526 of these are highly sensitive AWS root keys.
- Hugging Face identified as a major source of leaked credentials.
- Lack of key rotation and budget alerts leaves companies vulnerable.
A staggering security failure has been uncovered by Truffle Security, revealing that more than 9,300 Amazon Web Services (AWS) access keys publicly exposed between August 2022 and August 2026 remain active and valid. This exposure places the digital infrastructure of numerous corporations at immediate risk of takeover.
The scale of the breach is profound. Researchers found that 817 of the exposed keys were directly linked to corporate entities, with 526 of those being AWS root keys. Root keys represent the highest level of privilege, bypassing standard Identity and Access Management (IAM) restrictions and granting absolute authority over an entire AWS account.
Why This Matters
BozokMedia analysis shows that the implications of such a breach extend far beyond mere data theft. With 'AdministratorAccess' permissions, an attacker can create rogue accounts, wipe entire databases, or deploy cryptominers to hijack computing power, leading to astronomical cloud billing costs for the victimized company. The ability to exfiltrate or destroy mission-critical data makes this a Tier-1 security emergency.
Valid credentials effectively bypass most perimeter defenses, making the attacker indistinguishable from a legitimate administrator.
The investigation highlighted Hugging Face as a significant contributor to the leak, accounting for 8,482 unique key exposures. Furthermore, the study revealed a systemic failure in security hygiene: the median age of the exposed keys was approximately 1,831 days, indicating that most organizations have failed to implement basic key rotation policies.
| Metric | Findings |
|---|---|
| Total Exposed Keys | 64,024 Unique Keys |
| Active/Valid Keys | ~9,300+ |
| Root Keys Found | 526 |
| Accounts with Budget Alerts | ~9.5% |
The data suggests a dangerous lack of oversight. Out of 2,754 readable accounts, only 262 had budget alerts configured. This lack of monitoring means a company might not realize they are being exploited by unauthorized cryptomining until the monthly bill arrives.
Frequently Asked Questions
1. What is the danger of an AWS Root Key leak?
A root key provides unrestricted access to every service and resource in an AWS account, allowing an attacker to control everything from billing to data deletion.
2. How can companies protect themselves?
Companies should delete root access keys, implement regular credential rotation, use IAM roles instead of long-term keys, and set up strict budget alerts.
