# Hundreds of Leaked AWS Keys Expose Corporate Cloud Accounts

> Research reveals over 9,000 publicly exposed Amazon Web Services access keys remain active, including hundreds of root and administrator credentials.

- Published: 2026-08-21T16:21:53.000Z
- Severity: high
- Category: Cloud Security
- Tags: AWS, Credential Theft, Cloud Security, IAM, Data Breach
- Author: Runtime Rebel Intel
- Primary source: https://www.bleepingcomputer.com/news/security/hundreds-of-leaked-aws-keys-give-full-control-over-corporate-accounts/
- Canonical: https://runtimerebel.com/blog/hundreds-of-leaked-aws-keys-expose-corporate-cloud-accounts

## Key points

- Immediate impact: over 9,300 publicly exposed AWS access keys remain active, granting full control over corporate cloud environments.
- Affected systems: Amazon Web Services accounts, IAM user profiles, and root accounts embedded within public code repositories and CI logs.
- Remediation: delete all root access keys, rotate exposed credentials immediately, and configure cloud budget alerts to detect anomalous resource consumption.

A multi-year investigation by Truffle Security has uncovered thousands of active Amazon Web Services (AWS) access keys exposed across public code repositories, Git histories, datasets, Docker images, and CI logs. According to [BleepingComputer](https://www.bleepingcomputer.com/news/security/hundreds-of-leaked-aws-keys-give-full-control-over-corporate-accounts/), researchers tracked over 9,300 active and valid AWS access keys between August 2022 and August 2026. The findings highlight severe risks associated with credential leakage and poor secret management in enterprise cloud environments.

## Technical Analysis of Exposed AWS Credentials

Out of the extracted data, researchers identified 817 keys linked directly to corporate entities, including 526 AWS root keys and 242 Identity and Access Management ([IAM](/glossary#iam)) user keys possessing the `AdministratorAccess` policy. This level of privilege grants full control to create, modify, delete, and view virtually all AWS services and resources within a compromised account.

Key findings from the analysis include:

* **High Privilege Exposure:** Of the live keys providing full account control, 526 were root keys which bypass standard IAM restrictions.
* **Lack of Rotation:** For keys with available creation dates, the median age was 1,831 days, and only 13.7% had an associated newer access key, indicating a widespread failure to rotate credentials.
* **Source Distribution:** Hugging Face accounted for the largest single source of leaked keys, representing 8,482 unique key exposures, of which 17.9% were root identities.

Full administrative access to an AWS account allows malicious actors to exfiltrate or wipe stored data, manipulate cloud infrastructure, and establish persistent access by creating rogue administrator accounts. Furthermore, threat actors frequently leverage compromised cloud infrastructure to deploy cryptominers, generating catastrophic financial losses for organizations. Notably, Truffle Security discovered that only 262 of 2,754 readable accounts maintained active budget alerts to detect unusual billing spikes.

## Mitigations and Remediation Steps

Security teams must treat any credential committed to a public source as definitively compromised. Organizations operating in cloud environments should prioritize the following defensive measures:

* **Delete Root Access Keys:** Eliminate long-lived root access keys entirely and rely solely on multi-factor authentication for necessary root-level tasks.
* **Audit IAM Permissions:** Regularly review IAM credentials by age and scope, enforcing the principle of [least privilege](/glossary#least-privilege) across all user and service roles.
* **Implement Secret Scanning:** Integrate automated secret detection tools into [CI/CD](/glossary#ci-cd) pipelines to prevent developers from committing credentials to public or internal repositories.
* **Configure Billing Alerts:** Establish automated budget alerts and anomaly detection to identify unauthorized resource provisioning, such as unexpected cryptomining workloads.

**Related:** [City-Forum Data Theft Targets Salesforce and ServiceNow Portals](/blog/city-forum-data-theft-targets-salesforce-and-servicenow-portals), [Amazon Q Flaw: Cloud Credential Theft via Malicious Repositories](/blog/amazon-q-flaw-cloud-credential-theft-via-malicious-repositories)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/hundreds-of-leaked-aws-keys-expose-corporate-cloud-accounts