Reported by 3 outlets

Timeline

1. original reporting

   768 Leaked AWS Keys Expose Corporate Cloud Accounts to Full Admin Takeover

   cyberpress.org · 52d ago · August 22nd, 2026

   A newly identified 768 active, publicly exposed AWS access keys could provide attackers with complete administrative control over corporate cloud accounts. The credentials include 526 root access keys and 242 IAM user keys assigned AWS’s AdministratorAccess permission, creating a direct path to account takeover, infrastructure abuse, data theft, and potentially substantial cloud-billing fraud. The findings stem from a large-scale review of credentials that were publicly exposed between August 2022 and August 2026. Truffle Security re-verified 10,616 AWS key pairs on August 10 and found that 88% still authenticated successfully. The keys originated from publicly accessible Git histories, Hugging Face datasets , Docker images, package registries, and CI/CD logs. 768 Leaked AWS Keys Expose Corporate Cloud Accounts Although no credential material or account identities were disclosed, the scale of the problem illustrates how exposed secrets can remain usable long after their original publication. Across the wider dataset, researchers verified 64,024 unique AWS access key pairs from 431,875 publicly identified findings. Of these, 10,625 were root credentials, accounting for 16.6% of the total. A root access key is among the most severe AWS security failures because it cannot be constrained by IAM permissions . 2,903 keys that permitted (Source: Truffle Security ) Anyone holding a valid root key effectively becomes the account owner, with the ability to modify security controls, acc

2. update from bleepingcomputer.com

   Hundreds of leaked AWS keys give full control over corporate accounts

   bleepingcomputer.com · 53d ago · August 21st, 2026

   More than 9,300 Amazon Web Services (AWS) access keys publicly exposed between August 2022 and August 2026 are still active and valid. Truffle Security has been tracking this exposure for the past four years and says that 817 of the exposed keys were linked to companies, 526 of them being AWS root keys. According to the researchers, 242 of the keys are associated with Identity and Access Management (IAM) users with the AdministratorAccess policy. This role has full permissions to create, modify, delete, and view virtually all AWS services and resources within an account. They note that each key of the 768 live keys in the two sets “full control of a company's AWS account.” The company found 431,875 AWS secrets across code repositories, Git history, datasets, Docker images, registries, and CI logs and extracted 64,024 unique AWS keys that corresponded to 50,654 AWS accounts after removing duplicates. Unique verified exposed AWS keys Source: Truffle Security However, the subset for which the researchers had complete credentials that could be used for re-verification was 10,616 keys, and 88% of them continued to authenticate as of August 10. Amazon Web Services (AWS) is Amazon’s cloud-computing platform used by companies to host websites and applications, store data, run databases and servers, manage domains, and operate their online infrastructure. Full control of a company’s AWS account could allow an attacker to access, exfiltrate, or wipe cloud-hosted data, take control of s

3. update from gbhackers.com

   768 Leaked AWS Keys Still Active With Full Admin Access to Corporate Accounts

   gbhackers.com · 52d ago · August 22nd, 2026

   The credentials include 526 root access keys and 242 IAM user keys attached to AWS’s AdministratorAccess managed […] The post 768 Leaked AWS Keys Still Active With Full Admin Access to Corporate Accounts appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .