Nearly 10,000 AWS Security Keys Left Exposed for Years, Still Posing Active Risk

A Major Security Vulnerability Left Unchecked

A significant security problem has come to light involving cloud computing services from Amazon Web Services (AWS). Between August 2022 and August 2026, more than 9,300 digital access keys—think of them as master passwords for cloud accounts—became publicly visible on the internet. What makes this situation worse is that many of these keys have never been deactivated and remain fully functional today.

These access keys are like physical keys to a building. Once exposed, anyone who finds them can potentially unlock doors they shouldn't have access to. In this case, the doors lead to sensitive business data, applications, and computing resources stored in AWS systems.

Why This Matters for Organizations

For companies using AWS to store their operations, this represents a serious threat. An active access key in the wrong hands means someone could:

• Steal confidential business information or customer data
• Launch attacks against company systems
• Run expensive computing operations at the company's expense
• Modify or delete critical applications and databases
• Cover their tracks by erasing logs of their activities

The four-year window during which these keys were exposed—and the fact that some remain active—demonstrates how easily security problems can slip through the cracks. Many organizations might not even realize their credentials have been compromised.

Understanding the Timeline

The exposure window spanning from mid-2022 through mid-2026 is particularly troubling because it's a long period. During this time, attackers could have discovered and exploited these keys repeatedly. Even though the exposure period ended in August 2026, the active keys continue to present a current danger.

This situation highlights a common problem in cybersecurity: organizations often discover breaches long after they occur. The longer the gap between exposure and discovery, the greater the potential damage.

What This Means for You

If your organization uses AWS services, you need to take this seriously. Your company's cloud security depends on properly managing and protecting these access keys.

For everyday users, this affects you indirectly. If your data is stored with a company using AWS, this vulnerability could potentially impact your personal information. For businesses, this serves as a reminder that cloud security requires constant attention.

Steps Organizations Should Take Right Now

• Audit all active keys: Review every access key currently in use across your AWS accounts
• Check for unusual activity: Search logs for suspicious access patterns from unusual locations or times
• Rotate credentials: Deactivate old keys and create new ones immediately
• Implement monitoring: Set up alerts to detect when access keys are used inappropriately
• Use better security practices: Consider adopting temporary credentials instead of permanent keys
• Educate your team: Ensure employees understand they should never share or accidentally expose these keys online

Prevention Going Forward

Organizations should implement automated systems that scan their environments for accidentally exposed keys before they become public. Tools exist specifically for this purpose and can catch mistakes before hackers do.

This incident reminds us that cloud security requires vigilance, regular audits, and prompt action when problems emerge.