768 Leaked AWS Keys Expose Corporate Cloud Accounts to Full Admin Takeover
Brief
A newly identified 768 active, publicly exposed AWS access keys could provide attackers with complete administrative control over corporate cloud accounts.
The credentials include 526 root access keys and 242 IAM user keys assigned AWS’s AdministratorAccess permission, creating a direct path to account takeover, infrastructure abuse, data theft, and potentially substantial cloud-billing fraud.
The findings stem from a large-scale review of credentials that were publicly exposed between August 2022 and August 2026. Truffle Security re-verified 10,616 AWS key pairs on August 10 and found that 88% still authenticated successfully.
The keys originated from publicly accessible Git histories, Hugging Face datasets , Docker images, package registries, and CI/CD logs.