768 Leaked AWS Keys Still Active With Full Admin Access to Corporate Accounts

Gbhackers •Eswar • August 22, 2026

A large-scale investigation has uncovered 768 publicly exposed AWS access keys that remain active and grant full administrative privileges to corporate cloud environments, posing a serious risk of account takeover, data theft, infrastructure abuse, and cloud billing fraud. The credentials include 526 root access keys and 242 IAM user keys attached to AWS’s AdministratorAccess managed […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

768 Leaked AWS Keys Grant Full Admin Access to Corporate Accounts A recent investigation by Truffle Security revealed that 768 AWS access keys, including 526 root keys, remain active and grant full administrative privileges to corporate accounts. These keys were publicly exposed between August 2022 and August 2026, with 88% still authenticating as of August 10, 2026. The keys were found across various sources, including GitHub repositories and datasets, with Hugging Face being the largest contributor. The potential impact includes unauthorized access to sensitive data, infrastructure abuse, and significant financial charges due to misuse. Only a small fraction of the compromised accounts had budget alerts set up, highlighting a lack of proactive security measures. Truffle Security has notified identifiable owners of the exposed credentials and recommends immediate action to rotate or revoke the compromised keys. 7 sources 69

Extracted Entities

768 Leaked AWS Keys Still Active With Full Admin Access to Corporate Accounts

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)