# Background
Cloud security must be threat-informed. This repository compiles public data on security incidents impacting AWS customers, to guide prioritized security investment.
This repository seeks to index all publicly disclosed AWS customer security incidents with a known root cause.
It will exclude incidents involving exposed data stores (e.g S3 bucket leaks, exposed managed or hosted databases). Those incidents are already well understood, and examples can be found cataloged in places like [nagwww's s3-leaks repo](https://github.com/nagwww/s3-leaks), [upguard's reports](https://www.upguard.com/breaches), [hackmeggedon's annual rollup reports (2022)](https://www.hackmageddon.com/2022/02/21/leaky-buckets-in-2022/) and [Corey Quinn's LWIAWS](https://www.lastweekinaws.com) S3 Bucket Negligence Award.
### A Note on Blameless Postmortems
This repository is in no way intended as a criticism of the listed companies. In the spirit of blameless postmortems [<sup>1</sup>](#1), our goal is to learn from incidents without an atmosphere of blame.
# Catalog of AWS Customer Security Incidents
A repository of breaches of AWS customers
| Name | Date | Root Cause | Escalation Vector(s) | Impact | Link to details|
| ------------- | ------------- | ------------- | ------------- | ------------- | ------------- |
| Uber | 2014, May | GitHub Gist (data analysis script) with AWS credentials | N/A | 50,000 records, including names and driver’s licenses from S3 hosted database prunes | [Exclusive: In lawsuit over hacking, Uber probes IP address assigned to Lyft exec - sources ](https://www.reuters.com/article/uk-uber-tech-lyft-hacking-exclusive/exclusive-in-lawsuit-over-hacking-uber-probes-ip-address-assigned-to-lyft-exec-sources-idUKKCN0S20D020151008), [A blameless post-mortem of USA v. Joseph Sullivan](https://magoo.medium.com/a-blameless-post-mortem-of-usa-v-joseph-sullivan-a137162f7fc9) |
| Code Spaces | 2014, June | AWS Console Credentials (Phishing?) | Attacker created additional accounts/access keys | Wiped S3 buckets, EC2 instances, AMIs, EBS snapshots | [Hacker puts code spaces out of business](https://threatpost.com/hacker-puts-hosting-service-code-spaces-out-of-business/106761/) |
| BrowserStack | 2014, November | Shellshock on exposed, outdated prototype machine | Access keys on server, used to create IAM user, create EC2, and mount backup | Steal user data and email users | [BrowserStack analysis](http://archive.today/rsmmS) |
| DNC Hack by the GRU | 2016, June | Unknown, test clusters breached | EC2 Snapshots copied to attacker AWS accounts | Tableau and Vertica Queries | [DEMOCRATIC NATIONAL COMMITTEE v. THE RUSSIAN FEDERATION](https://www.politico.com/f/?id=00000168-6161-de11-af7d-ef7327ea0000) |
| DataDog | 2016, July | CI/CD AWS access key and SSH private key leaked | Attacker attempted to pivot with customer credentials | 3 EC2 instances and subset of S3 buckets | [2016-07-08 Security Notice](https://web.archive.org/web/20201128071102/https://www.datadoghq.com/blog/2016-07-08-security-notice/) |
| Uber | 2016, October | ~13 Hacked Uber credentials purchased for forum gave access to private GitHub Repo with AWS credentials | N/A | Names and driver’s license numbers of 600k drivers, PII of 57 million users in unencrypted manual backup| [Uber concealed cyberattack ...](https://web.archive.org/web/20210824171652/https://www.bloomberg.com/news/articles/2017-11-21/uber-concealed-cyberattack-that-exposed-57-million-people-s-data), [A blameless post-mortem of USA v. Joseph Sullivan](https://magoo.medium.com/a-blameless-post-mortem-of-usa-v-joseph-sullivan-a137162f7fc9) |
| Lynda.com | 2016, December | Private GitHub Repo with AWS credentials | N/A | User data for 9.5m users, attempted extortion | [2 Plead Guilty in 2016 Uber and Lynda.com Hacks](http://archive.today/oU2ZL) |
| OneLogin | 2017, May | AWS keys | Created EC2 instances | Accessed database tables (with encrypted data) | [May 31, 2017 Security Incident](https://web.archive.org/web/20210620180614/https://www.onelogin.com/blog/may-31-2017-security-incident) |
| Politifact | 2017, October | "Misconfigured cloud computing server" | N/A | Coinhive cryptojacking | [Hackers have turned Politifact’s website into a trap for your PC](https://web.archive.org/web/20200806102838/https://www.washingtonpost.com/news/the-switch/wp/2017/10/13/hackers-have-turned-politifacts-website-into-a-trap-for-your-pc/) |
| Dataspline | 2017, Unknown | Monero miner in container base image dependency | N/A | Monero cryptojacking | [LinkedIn post from co-founder](https://www.linkedin.com/feed/update/urn:li:activity:7219713829528563712) |
| DXC Technologies | 2017, November | Private AWS key exposed via GitHub | 244 EC2 instance started | Cryptomining | [DXC spills AWS private keys on public GitHub](https://web.archive.org/web/20210228215919/https://www.theregister.com/2017/11/14/dxc_github_aws_keys_leaked/) |
| Drizly | 2018 | AWS Credentials committed to public github repo | N/A | Cryptojacking | [FEDERAL TRADE COMMISSION - Drizly Complaint](https://www.ftc.gov/news-events/news/press-releases/2022/10/ftc-takes-action-against-drizly-its-ceo-james-cory-rellas-security-failures-exposed-data-25-million) |
| LA Times | 2018, February | S3 global write access | N/A | Cryptojacking | [Coinhive cryptojacking added to homicide.latimes.com](https://web.archive.org/web/20210413201832/https://www.tripwire.com/state-of-security/security-data-protection/la-times-website-cryptojacking-attack/) |
| Tesla | 2018, February | Globally exposed Kubernetes console, Pod with AWS credentials | N/A | Cryptojacking | [Hack Brief: Hackers Enlisted Tesla's Public Cloud to Mine Cryptocurrency](https://www.wired.com/story/cryptojacking-tesla-amazon-cloud/) |
| Chegg | 2018, April | Former contractor abuses broadly shared root credential | Unknown | 40 million users' data (from S3 bucket) | [FTC Complaint](https://www.ftc.gov/system/files/ftc_gov/pdf/2023151-Chegg-Complaint.pdf) |
| imToken | 2018, June | Email account compromise | Reset AWS account password | Minimal customer device data | [ Disclosure of Security Incidents on imToken ](https://archive.ph/bRjXi) |
| Reddit | 2018, June | Employee SMS intercepted for 2FA bypass | N/A | Internal systems accessed, user data including messages | [We had a security incident. Here's what you need to know.](https://www.reddit.com/r/announcements/comments/93qnm5/we_had_a_security_incident_heres_what_you_need_to/) |
| Timehop | 2018, July | Compromised admin credentials without MFA | N/A | 21 million users' data including emails, phone numbers, social media tokens | [TechCrunch](https://techcrunch.com/2018/07/09/timehop-discloses-july-4-data-breach-affecting-21-million/) |
| Voova | 2019, March | Stolen credentials by former employee | N/A | Deleted 23 servers | [Sacked IT guy annihilates 23 of his ex-employer’s AWS servers](https://nakedsecurity.sophos.com/2019/03/22/sacked-it-guy-annihilates-23-of-his-ex-employers-aws-servers/) |
| Capital One | 2019, April | "Misconfigured WAF" that allowed for a SSRF attack | Over-privileged EC2 Role | 100 million credit applications | [A Technical Analysis of the Capital One Cloud Misconfiguration Breach](https://cloudsecurityalliance.org/blog/2019/08/09/a-technical-analysis-of-the-capital-one-cloud-misconfiguration-breach) |
| JW Player | 2019, September | Weave Scope (publicly exposed), RCE by design | N/A | Cryptojacking | [How A Cryptocurrency Miner Made Its Way onto Our Internal Kubernetes Clusters](https://web.archive.org/web/20210828044334/https://medium.com/jw-player-engineering/how-a-cryptocurrency-miner-made-its-way-onto-our-internal-kubernetes-clusters-9b09c4704205) |
| Malindo Air | 2019, September | Former employee insider threat | N/A | 35 million PII records | [ Malindo Air: Data Breach Was Inside Job](https://www.infosecurity-magazine.com/news/malindo-air-data-breach-was-inside/) |
| Imperva | 2019, October | “Internal compute instance” globally accessible, “Contained” AWS API key | N/A | RDS snapshot stolen | [Imperva Security Update](https://web.archive.org/web/20210620143023/https://www.imperva.com/blog/ceoblog/) |
| Cameo | 2020, February | Credentials in mobile app package | N/A | Access to backend infrastructure, including user data | [Celeb Shout-Out App Cameo Exposes Private Videos and User Data](https://www.vice.com/en/article/akwj5z/cameo-app-exposed-private-videos-user-data-passwords) |
| Open Exchange Rates | 2020, March | Third-party compromise exposing access key | N/A | User database | [Exchange rate service’s customer details hacked via AWS](https://nakedsecurity.sophos.com/2020/03/20/exchange-rate-services-customer-details-hacked-via-aws/) |
| First Republic Bank | 2020, March | Fired employee incompletely offboarded | N/A | System interruption | [First Republic Bank](https://www.breaches.cloud/incidents/first-republic/) |
| Live Auctioneers | 2020, July | Compromised third party software granting access to cloud environment | N/A | User database, including MD5 hashed credentials | [Washington State OAG - Live Auctioneers](https://www.atg.wa.gov/live-auctioneers/) |
| Twilio | 2020, July |S3 global write access | N/A | Magecart[<sup>2</sup>](#2) | [Incident Report: TaskRouter JS SDK Security Incident](https://web.archive.org/web/20210813010417/https://www.twilio.com/blog/incident-report-taskrouter-js-sdk-july-2020) |
| Natures Basket responsible disclosure | 2020, July | Hard-coded root keys in source code exposed via public S3 bucket | N/A | N/A | [GotRoot! AWS root Account Takeover](https://web.archive.org/web/20200825004529/https://medium.com/@gchib/naturesbasket-aws-root-account-takeover-e4aa5c5e95e1) |
| Drizly | 2020, July | Inactive GitHub account compromised via reused password, granting AWS credential access in source code | N/A | RDS Instance with 2.5 million users data exfiltrated | [FTC Takes Action Against Drizly and its CEO James Cory Rellas for Security Failures that Exposed Data of 2.5 Million Consumers](https://archive.ph/p21Vk) |
| Cryptomining AMI | 2020, August | Windows 2008 Server Community AMI | N/A | Monero miner | [Cryptominer Found Embedded in AWS Community AMI](https://web.archive.org/web/20210625192906/https://www.darkreading.com/cloud/cryptominer-found-embedded-in-aws-community-ami/d/d-id/1338713/) |
| Global Tel*Link (GTL) | 2020, August | Unprotected test data in AWS cloud | N/A | 650K users' sensitive data (SSN, DOB, messages) sold on dark web | [FTC Complaint](https://www.ftc.gov/system/files/ftc_gov/pdf/Complaint-GlobalTelLink.pdf) |
| ShopBack | 2020, September | AWS access key exposed in GitHub commit history | Modified security settings, created staging database instance | 1.45M users' data including emails, bank accounts, partial credit cards | [PDPC Decision](https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Commissions-Decisions/Decision---Ecommerce-Enablers.pdf) |
| RedMart | 2020, September | AWS keys embedded in source code in S3 bucket | N/A | 1.1M users' data (multi-cloud: AWS + Alibaba) | [PDPC Decision](https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/commissions-decisions/decision---redmart-limited---28102022.pdf) |
| Animal Jam | 2020, November | Slack compromise exposes AWS credentials | N/A | User database | [Kids' gaming website Animal Jam breached](https://web.archive.org/web/20210122070047/https://www.theregister.com/2020/11/12/animal_jam_breached/) |
| Cisco | 2020, December | Former employee with AWS access 5 months post-resignation | N/A | Deleted \~450 EC2 instances | [Former Cisco engineer sentenced to prison](https://web.archive.org/web/20210304053727/https://www.zdnet.com/article/former-cisco-engineer-sentenced-to-prison-for-deleting-16k-webex-accounts/) |
| Juspay | 2021, January | Compromised old, unrecycled Amazon Web Services (AWS) access key | N/A | Masked card data, email IDs and phone numbers | [Data from August Breach of Amazon Partner Juspay Dumped Online](https://web.archive.org/web/20210127001214/https://threatpost.com/data-from-august-breach-of-amazon-partner-juspay-dumped-online/162740/) |
| MobiKwik | 2021, March | Compromised AWS access key, S3 bucket accessed | N/A | 99M users' data, 3.5M KYC documents (Aadhaar, PAN), 8.2TB exfiltrated | [BankInfoSecurity](https://www.bankinfosecurity.com/blogs/mobikwik-data-breach-denial-be-nimble-but-so-quick-p-3010), [TechCrunch](https://techcrunch.com/2021/03/30/mobikwik-investigating-data-breach-after-100m-user-records-found-online/) |
| 20/20 Eye Care Network and Hearing Care Network | 2021, January | Compromised credential | N/A | S3 buckets accessed then deleted | [20/20 Eye Care Network and Hearing Care Network notify 3,253,822 health plan members of breach that deleted contents of AWS buckets](https://www.databreaches.net/20-20-eye-care-network-and-hearing-care-network-notify-3253822-health-plan-members-of-breach-that-deleted-contents-of-aws-buckets/) |
| Sendtech | 2021, February | (Current or former employee) Compromised credentials | Created additional admin account | Accessed customer data in S3 | [PERSONAL DATA PROTECTION COMMISSION Case No. DP-2102-B7884](https://web.archive.org/web/20220923025502/https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Commissions-Decisions/Decision---Sendtech-Pte-Ltd---220721.ashx?la=en) |
| Upstox | 2021, April | Compromised AWS key (ShinyHunters) | N/A | 2.5M users' KYC data (Aadhaar, PAN, passports, bank accounts) | [The Hacker News](https://thehackernews.com/2021/04/indian-brokerage-firm-upstox-suffers.html) |
| LogicGate | 2021, April | Compromised credentials | N/A | Backup files in S3 stolen | [Risk startup LogicGate confirms data breach](https://web.archive.org/web/20210519233848/https://techcrunch.com/2021/04/13/logicgate-risk-cloud-data-breach/) |
| Ubiquiti | 2021, April | Compromised credentials from IT employee Lastpass (alleged former employee insider threat) | N/A | root administrator access to all AWS accounts, extortion | [Ubiquiti All But Confirms Breach Response Iniquity](https://web.archive.org/web/20210731152054/https://krebsonsecurity.com/2021/04/ubiquiti-all-but-confirms-breach-response-iniquity/) |
| Uran Company | 2021, July | Compromised Drupal with API keys | N/A | Cryptomining | [Clear and Uncommon Story About Overcoming Issues With AWS](https://web.archive.org/web/20221205145546/https://topdigital.agency/clear-and-uncommon-story-about-overcoming-issues-with-aws/) |
| MyRepublic | 2021, August | AWS access key exposed via php-info URL, S3 bucket publicly accessible | N/A | 79K customers' NRIC/identity documents stolen, extortion | [PDPC Decision](https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/commissions-decisions/decision---myrepublic-ltd---05082022.pdf) |
| reddoorz.com | 2021, September | Access Key leaked via APK | N/A | Customer database stolen | [PERSONAL DATA PROTECTION COMMISSION Case No. DP-2009-B7057](https://web.archive.org/web/20211130202805/https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Commissions-Decisions/Decision---Commeasure-Pte-Ltd---15092021.pdf?la=en) |
| HPE Aruba | 2021, October | Unknown exposure of Access Key | N/A | Potential access to network telemetry and contact trace data | [Aruba Central Security Incident](https://www.arubanetworks.com/support-services/security-bulletins/central-incident-faq/) |
| Kaspersky | 2021, November | Compromised SES token from third party | N/A | Phishing attacks | [Kaspersky's stolen Amazon SES token used in Office 365 phishing](https://www.bleepingcomputer.com/news/security/kasperskys-stolen-amazon-ses-token-used-in-office-365-phishing/) |
| Illuminate Education | 2021, December | Stale former employee credentials (3.5 years post-departure) | AWS security groups modified, database passwords reset, resources deleted | 10.1M students' data exfiltrated from S3/SQL backups | [FTC Action](https://www.ftc.gov/news-events/news/press-releases/2025/12/ftc-takes-action-against-education-technology-provider-failing-secure-students-personal-data) |
| Eye Care Leaders | 2021, December | Unknown | Unknown | deleted databases and system configuration files, potential theft of [1.5M patient records](https://healthitsecurity.com/news/eye-care-leaders-emr-breach-impacts-at-least-342k-individuals) | [Augusta University Health - Breach Disclosure [PDF]](https://dojmt.gov/wp-content/uploads/Augusta-University-Medical-Center-Consumer-Notification-Letter.pdf) |
| Onus | 2021, December | Log4Shell vulnerability in Cyclos server | AmazonS3FullAccess creds (and DB creds) in Cyclos config | 2 million ONUS users’ information including EKYC data, personal information, and password hash was leaked. | [The attack on ONUS – A real-life case of the Log4Shell vulnerability](https://cystack.net/research/the-attack-on-onus-a-real-life-case-of-the-log4shell-vulnerability) |
| Flexbooker | 2021, December | Unknown | Unknown | 3.7M first and last names, email addresses, phone numbers, "encrypted" passwords | [Booking management platform FlexBooker leaks 3.7 million user records](https://therecord.media/booking-management-platform-flexbooker-leaks-3-7-million-user-records/) |
| npm | 2022, April | Third party OAuth token compromise granting private repository access, containing AWS keys | Unknown | 100k users data (from 2015) | [npm security update: Attack campaign using stolen OAuth tokens](https://github.blog/2022-05-26-npm-security-update-oauth-tokens/) |
| PREMINT | 2022, July | S3 global write access | Unknown | NFT Theft (supply chain) | [Full Analysis of the PREMINT Attack Incident](https://www.chaincatcher.com/en/article/2076680) |
| Uber | 2022, September | Contractor account compromise leading to AWS credential discovery on a shared drive | Unknown | N/A | [Uber - Security update](https://www.uber.com/newsroom/security-update/) |
| Lastpass | 2022, October | Stole source code and accessed development environment via compromised developer account (an IAM User) | Unknown pivot point into production environment. Later compromise of a privileged engineer's personal machine to gain access to decryption keys for stolen data | Internal and customer data broadly compromised, including backups of MFA database | [Notice of Recent Security Incident](https://support.lastpass.com/help/incident-2-additional-details-of-the-attack),[Incident 2 – Additional details of the attack](https://support.lastpass.com/help/incident-2-additional-details-of-the-attack), [Breaking the Vault: A Case Study of the 2022 LastPass Data Breach](https://arxiv.org/pdf/2502.04287) |
| FTX | 2022, November | Private keys in Secrets Manager without HSM protection, GuardDuty not enabled | Unknown, credentials broadly accessible to employees | $432M+ cryptocurrency stolen during bankruptcy chaos | [breaches.cloud](https://www.breaches.cloud/incidents/ftx/) |
| Medibank | 2022, October | Compromised credentials | Unknown | Data exfiltration from Redshift / "Ransomware" | [Medibank now says hackers accessed all its customers’ personal data](https://www.bleepingcomputer.com/news/security/medibank-now-says-hackers-accessed-all-its-customers-personal-data/), [Amazon Redshift gets new default settings to prevent data breaches](https://www.bleepingcomputer.com/news/security/amazon-redshift-gets-new-default-settings-to-prevent-data-breaches/) |
| Sonder | 2022, November | Unknown | Unknown | Theft of customer information, attempted extortion | [Security Update](https://blog.sonder.com/news/security-update/), [Breach Notification](https://dojmt.gov/wp-content/uploads/Consumer-Notification-Letter-816.pdf) |
| Teqtivity (Uber Vendor) | 2022, December | Unknown | Unknown | "AWS backup server" with device and user information | [Breach Notification Statement](https://www.teqtivity.com/breach-notification-statement), [Uber suffers new data breach after attack on vendor, info leaked online](https://www.bleepingcomputer.com/news/security/uber-suffers-new-data-breach-after-attack-on-vendor-info-leaked-online/) |
| CommuteAir | 2023, January | Publicly Exposed Jenkins with hardcoded credentials | N/A | 2019 FAA No Fly List | [how to completely own an airline in 3 easy steps](https://maia.crimew.gay/posts/how-to-hack-an-airline/), [U.S. airline accidentally exposes ‘No Fly List’ on unsecured server](https://www.dailydot.com/debug/no-fly-list-us-tsa-unprotected-server-commuteair/) |
| Episource | 2023, February | Unauthorized access to AWS environment | Ransomware | 5.4 million healthcare records | [HIPAA Journal](https://www.hipaajournal.com/episource-data-breach/) |
| Coffee Meets Bagel | 2023, August | Unknown | N/A | Data deletion, 7-day service outage | [The Register](https://www.theregister.com/2023/08/15/coffee_meets_bagel_hack/) |
| Cloudflare | 2023, November | Pivot from Okta compromise due to un-rotated access token | N/A | N/A | [Cloudflare - Thanksgiving 2023 security incident](https://web.archive.org/web/20240201200520/https://blog.cloudflare.com/thanksgiving-2023-security-incident/) |
| Sumo Logic | 2023, November | Compromised credential | N/A | N/A | [Sumo Logic Security Notice](https://www.sumologic.com/solutions/security/response-center) |
| Football Australia | 2024, February | AWS access key embedded in website HTML | N/A | 126 S3 buckets, player passports, contracts, ticket buyer data | [breaches.cloud](https://www.breaches.cloud/incidents/footballaustralia/) |
| Sisense | 2024, April | Credentials stolen from Gitlab repository | N/A | Terabytes of customer data exfiltrated from S3 | [Why CISA is Warning CISOs About a Breach at Sisense](https://krebsonsecurity.com/2024/04/why-cisa-is-warning-cisos-about-a-breach-at-sisense/) |
| Dropbox Sign | 2024, May | Service account compromise | N/A | Customer authentication data (emails, names, API keys, OAuth tokens) | [A Recent Security Incident Involving Dropbox Sign](https://sign.dropbox.com/blog/a-recent-security-incident-involving-dropbox-sign) |
| pcTattletale | 2024, May | Application vulnerability disclosed `root` AWS keys | N/A | Data published publicly | [Spyware app pcTattletale was hacked and its website defaced](https://techcrunch.com/2024/05/25/spyware-app-pctattletale-was-hacked-and-its-website-defaced/), [defaced site](https://web.archive.org/web/20240525013915/https://www.pctattletale.com/) |
| Quadrant Global | 2024, May | Jenkins CVE-2024-23897 exploited on EC2 | AWS access key stolen, S3 bucket accessed | 75K Geolancer app users' data sold on dark web | [PDPC Undertaking](https://www.pdpc.gov.sg/undertakings/undertaking-by-quadrant-global-pte-ltd) |
| FinWise Bank / American First Finance | 2024, May | Former employee insider threat | RDS database accessed via residual credentials | 689K customers' SSNs, financial data | [BleepingComputer](https://www.bleepingcomputer.com/news/security/finwise-insider-breach-impacts-689k-american-first-finance-customers/), [The Register](https://www.theregister.com/2025/09/15/finwise_insider_data_breach/) |
| Relay Graduate School of Education | 2024, November | Unknown | AWS-hosted applications accessed, files deleted | 22,769 student records (PII) | [Breach Notification](https://www.mass.gov/doc/2025-81-relay-graduate-school-of-education/download) |
| BeyondTrust | 2024, December | 0day vulnerability in a 3p application | infrastructure API key to pivot cross-account | Customer Instances compromised | [BeyondTrust Remote Support SaaS Service Security Investigation](https://www.beyondtrust.com/remote-support-saas-service-security-investigation) |
| TinaCloud | 2024, December | Credentials leaked in JS file | N/A | SES abuse for phishing | [TinaCloud: Public Disclosure of Security Breach](https://tina.io/blog/2024-12-tinacloud-public-disclosure-security-breach) |
| Otelier | 2025, January | Infostealer | Credentials found in Bitbucket | 8TB of data exfiltrated from S3 | [Otelier data breach exposes info, hotel reservations of millions](https://www.bleepingcomputer.com/news/security/otelier-data-breach-exposes-info-hotel-reservations-of-millions/) |
| Gravy Analytics | 2025, January | Misappropriated AWS access key | AWS cloud storage accessed | 17TB claimed, 30M+ verified location data points from thousands of apps | [TechCrunch](https://techcrunch.com/2025/01/13/gravy-analytics-data-broker-breach-trove-of-location-data-threatens-privacy-millions/), [The Record](https://therecord.media/location-data-broker-gravy-breach) |
| Bybit / Safe{Wallet} | 2025, February | Safe{Wallet} developer macOS compromised via social engineering | Stolen AWS token used to inject malicious JavaScript in S3 bucket | $1.5 Billion stolen | [Sygnia Case Study](https://www.sygnia.co/case-study/bybit-heist-case-study/), [lazarus.day](https://lazarus.day/incidents/bybit/) |
| AngelOne | 2025, March | Unknown | N/A | Data exfiltration | [Indian Stock Broker Angel One Discloses Data Breach](https://www.securityweek.com/indian-stock-broker-angel-one-discloses-data-breach/) |
| Pearson | 2025, March | Exposed GitLab token in `.git/config` | AWS credentials in source code | Data exfiltration | [Education giant Pearson hit by cyberattack exposing customer data](https://www.bleepingcomputer.com/news/security/education-giant-pearson-hit-by-cyberattack-exposing-customer-data/) |
| BitoPro | 2025, May | Social engineering of cloud ops employee, malware | AWS session token hijacked to bypass MFA | $11M cryptocurrency stolen | [BleepingComputer](https://www.bleepingcomputer.com/news/security/bitopro-exchange-links-lazarus-hackers-to-11-million-crypto-heist/), [lazarus.day](https://lazarus.day/incidents/bitopro/) |
| KiranaPro | 2025, June | Former employee, post layoff | N/A | Service disruption | [Indian grocery startup KiranaPro was hacked and its servers deleted, CEO confirms](https://techcrunch.com/2025/06/03/indian-grocery-startup-kiranapro-was-hacked-and-its-servers-deleted-ceo-confirms/), [KiranaPro Crisis Explained: Ex-Employee’s Revenge Move that Paralysed the App](https://www.outlookbusiness.com/start-up/explainers/kiranapro-crisis-explained-ex-employees-revenge-move-that-paralysed-the-app) |
| Salesloft (Drift) | 2025, August | GitHub repository compromise (UNC6395) | AWS environment accessed, OAuth tokens stolen | 700+ Salesforce instances compromised | [Google Cloud](https://cloud.google.com/blog/topics/threat-intelligence/unc6395-github-malware-salesforce-data), [Salesloft Security Update](https://trust.salesloft.com/) |
| Kodex | 2025, October | Fraudulent legal domain transfer order | N/A | Outage when domain frozen | [Subpoena tracking platform blames outage on AWS social engineering attack](https://www.theregister.com/2025/10/02/subpoena_tracking_platform_outage_blamed/) |
| Kiln | 2025, October | Compromised GitHub Access Token | Credentials stolen from GitHub Actions, modify running API logic | Cryptocurrency theft | [Re-enablement of Kiln services and security incident information](https://www.kiln.fi/post/re-enablement-of-kiln-services-and-security-incident-information#) |
| Eurail B.V. | 2025, December | Unknown | S3, Zendesk, GitLab accessed | 308,777 travelers' data (passports, addresses) stolen, 1.3TB exfiltrated | [SecurityWeek](https://www.securityweek.com/300000-people-impacted-by-eurail-data-breach/), [Cybernews](https://cybernews.com/security/eurail-data-breach-passenger-data-sale/) |
| Aesto Health | 2025, December | Unknown | AWS infrastructure accessed | 9.5M patient records (PHI, SSNs, medical records, financial data) | [Breach Disclosure](https://www.aestohealth.com/notice-of-data-security-incident-12-18-25/) |
| つくるAI (Tsukuru AI) | 2026, February | Credentials stolen | N/A | AWS SES abused for 176K spam emails | [Security NEXT](https://www.security-next.com/181807), [Company site](https://tsukuru-ai.co.jp/) |
| LexisNexis | 2026, February | Unpatched React2Shell vulnerability (CVE-2025-55182) | AWS Secrets Manager, Redshift, VPC databases accessed | 2GB data including ~400K user profiles | [LexisNexis Legal & Professional confirms data breach](https://www.theregister.com/2026/03/04/lexisnexis_legal_professional_confirms_data/) |
| CareCloud | 2026, March | Unknown | AWS environment accessed | 3.75M individuals' medical, financial, and identity data | [Breach Notification](https://www.mass.gov/doc/2026-1225-carecloud-inc/download), [TechCrunch](https://techcrunch.com/2026/08/19/carecloud-confirms-3-7m-patients-had-their-medical-records-stolen-in-data-breach/) |
| BuddyBoss | 2026, March | CI/CD pipeline compromise via malicious GitHub Actions workflow | SSH credentials stolen, root access on AWS server, SSH key persistence | 246+ WordPress sites compromised via supply chain attack | [Ctrl-Alt-Intel - The BuddyBoss Attack: Full Incident Analysis](https://ctrlaltintel.com/research/BuddyBoss-2/) |
| European Commission | 2026, March | Trivy supply chain compromise (CVE-2026-33634) | AWS API key stolen from CI/CD | 340GB data from 71 EU entities, 52K email files | [CERT-EU - European Commission hack exposes data of 30 EU entities](https://www.bleepingcomputer.com/news/security/cert-eu-european-commission-hack-exposes-data-of-30-eu-entities/) |
| Resolv Labs | 2026, March | AWS KMS compromise (suspected Cisco firewall CVE-2026-20131) | KMS signing key access | $23-25M stolen via unauthorized USR stablecoin minting | [Halborn - Explained: The Resolv Hack](https://www.halborn.com/blog/post/explained-the-resolv-hack-march-2026) |
| Cisco | 2026, April | Trivy supply chain compromise (CVE-2026-33634) | AWS keys stolen, unauthorized cloud account access | 300+ repos exfiltrated (AI projects, customer data) | [SANS ISC - TeamPCP Supply Chain Campaign Update 007](https://isc.sans.edu/diary/32880) |
| Porter | 2026, April | Stale, overprivileged AWS access key | IAM role chaining to customer accounts | 21 customer accounts accessed, 3 GitHub repos cloned, secrets exposed | [Porter Security Incident Disclosure](https://gist.github.com/leetrout/2d172d2b95e8d24af0f3de0d0b03561e) |
| Context.ai | 2026, April | Infostealer on employee device (Lumma Stealer) | AWS environment accessed, OAuth tokens stolen enabling downstream Vercel breach | Customer OAuth tokens compromised, downstream access to Vercel employee accounts | [Context.ai Security Update](https://context.ai/security-update), [Vercel Bulletin](https://vercel.com/kb/bulletin/vercel-april-2026-security-incident) |
| Braintrust | 2026, May | Unknown (under investigation) | N/A | Customer API keys for AI models exposed | [TechCrunch - Braintrust confirms breach](https://techcrunch.com/2026/05/06/ai-evaluation-startup-braintrust-confirms-breach-tells-every-customer-to-rotate-sensitive-keys/) |
| Arup Group | 2026, May | GitHub personal access token in JavaScript file | AWS S3, Azure Blob, GitLab accessed | 2TB cloud data, 700GB repos, HS2 rail project files | [BushidoToken](https://blog.bushidotoken.net/2026/06/uk-cybercrime-journal-arup-group.html), [BrinzTech](https://www.brinztech.com/breach-alerts/brinztech-alert-alleged-3-5-tb-cloud-infrastructure-leak-of-arup-group/) |
| Beacon | 2026, July | AWS access key exposed in public JavaScript build artifacts | Database backups accessed | Full database copy with customer data exfiltrated | [Security Incident](https://www.beaconcrm.org/incident) |
| Hugging Face | 2026, July | HDF5 file read + Jinja2 template injection (exploited by autonomous AI agent) | IMDS credential theft, EKS node root, VPN pivot | AWS keys and credentials compromised, 5 datasets accessed | [Technical Timeline of the July 2026 Incident](https://huggingface.co/blog/agent-intrusion-technical-timeline) |
| JetBrains Cadence | 2026, August | Unpatched TeamCity vulnerability (CVE-2026-63077) | IAM credentials compromised, S3 buckets accessed | Personal data, 2024 backup with credentials, customer cloud credentials and source code | [Security Incident Affecting JetBrains Cadence](https://blog.jetbrains.com/pycharm/2026/08/cadence-security-incident-august-2026/) |
| MyDr | 2026, August | XXE vulnerability in PKCS#12 certificate handling (RCE) | GitHub API key stolen, source code accessed, AWS infrastructure compromised | 2.5TB data, 19M patient records (PESEL, prescriptions, medical notes) from 12K+ facilities | [The Record](https://therecord.media/poland-probes-mydr-healthcare-software-breach), [GovInfoSecurity](https://www.govinfosecurity.com/hack-on-med-software-firm-hits-half-polands-population-a-32580) |
| Zeabur | 2026, October | Plaintext AWS keys and cluster admin tokens in private config repository (suspected access via GitHub App private key leaked in August 2026) | Over-privileged IAM key read all S3 buckets including user database backups, attempted Amazon Bedrock calls; shared cluster admin across 9 regions, commands run in 865 database containers, user impersonation | 3.2M+ environment variable records, 321,810 accounts (email, username, phone) | [October 2026 Security Incident](https://zeabur.com/blogs/october-2026-security-incident) |
## Vendor-reported AWS Customer Security Incident Case Studies
| Report | Date | Root Cause | Escalation or Peristence Vector(s) | Impact | Link to details|
| ------------- | ------------- | ------------- | ------------- | ------------- | ------------- |
| Mandiant M-Trends 2020 | 2020, February | Credentials stolen from GitHub repository commit history | Takes snapshot of EBS volumes, creates EC2 instances, exfiltrates data over SSH | Stolen EBS volumes | [M-Trends 2020](https://web.archive.org/https://www.mandiant.com/sites/default/files/2021-09/mtrends-2020.pdf) |
| TeamTNT Worm | 2020, April | Misconfigured Docker & k8s platforms | Steals AWS credentials from \~/.aws/* | Cryptojacking for Monero | [Team TNT – The First Crypto-Mining Worm to Steal AWS Credentials](https://web.archive.org/web/20210607223609/https://www.cadosecurity.com/post/team-tnt-the-first-crypto-mining-worm-to-steal-aws-credentials/), [TeamTNT with new campaign aka “Chimaera”](https://cybersecurity.att.com/blogs/labs-research/teamtnt-with-new-campaign-aka-chimaera) |
| Expel case study 1 | 2020, April | 8 IAM access keys compromised | Backdoored security groups | Command line access to EC2 instances | [Finding evil in AWS: A key pair to remember](https://web.archive.org/web/20210226132628/https://expel.io/blog/finding-evil-in-aws/) |
| Expel case study 2 | 2020, July | Root IAM user access keycompromised | SSH keys generated for EC2 instances | Cryptojacking | [Behind the scenes in the Expel SOC: Alert-to-fix in AWS](https://web.archive.org/web/20210128055101/https://expel.io/blog/behind-the-scenes-expel-soc-alert-aws/) |
| Mandiant: Insider Threat Scenario | 2020, September | Fired employee uses credentials | Access CI/CD server, create a new user, steal credentials | Deleted production databases | [Cloud Breaches: Case Studies, Best Practices, and Pitfalls](https://web.archive.org/web/20201103091354/https://www.youtube.com/watch?v=rtEjI_5TPdw&feature=youtu.be/) |
| FireEye M-Trends 2021 case study | 2021, April | Use of SSH key by former employee | Creates users and EC2 instances | Deleted RDS backups | [M-Trends 2021](https://www.arrow.com/ecs-media/16352/fireeye-rpt-mtrends-2021.pdf) |
| DarkLab case study | 2021, July | Jenkins RCE | Create IAM users, use S3 Browser tool | Use environment to launch scanning, nuked account | [Trouble in Paradise](https://blog.darklab.hk/2021/07/06/trouble-in-paradise/) |
| Expel case study 3 | 2022, April | Credentials in publicly available code repository | AttachUserPolicy used for privesc | Cryptojacking (prevented) | [Incident report: From CLI to console, chasing an attacker in AWS](https://expel.com/blog/incident-report-from-cli-to-console-chasing-an-attacker-in-aws/) |
| Permiso case study 1 | 2022, June | Gitlab vulnerability (CVE-2021-22205) | Credentials on the system found, used to create a backup user | Cryptojacking | [Anatomy of an Attack: Exposed keys to Crypto Mining](https://web.archive.org/web/20220629061640/https://permiso.io/blog/s/anatomy-of-attack-exposed-keys-to-crypto-mining/) |
| Clearvector case study | 2022, August | ADFS pivot into IAM Identity Center | N/A | N/A | [Auditing identity activity for NOBELIUM and MagicWeb in AWS](https://www.clearvector.com/blog/auditing-identity-activity-for-nobelium-and-magicweb-in-aws/) |
| Positive Thinking Company case study | 2022, June | Unknown | N/A | Cryptojacking | [Mitigating a crypto jacking incident on an AWS machine from the earliest stages](https://positivethinking.tech/use-cases/mitigating-a-crypto-jacking-incident-on-an-aws-machine-from-the-earliest-stages/) |
| Palo Alto Unit 42 | 2022, December | Code execution in Lambda context | Exfiltrate credentials from envvars | SES abuse for phishing | [Compromised Cloud Compute Credentials: Case Studies From the Wild](https://unit42.paloaltonetworks.com/compromised-cloud-compute-credentials/) |
| Permiso case study 2 | 2022, December | Exploit publicly facing software, mainly Jupyter notebooks or k8s | N/A | Credential Theft | [Cloud Cred Harvesting Campaign - Grinch Edition](https://permiso.io/blog/s/christmas-cloud-cred-harvesting-campaign/) |
| Crowdstrike | 2022, December | Exploit known ForgeRock CVE | aws_consoler used to obtain pivot to console sessions without MFA | N/A | [Analysis of an Intrusion Campaign Targeting Telco and BPO Companies](https://web.archive.org/web/20230316062338/https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies) |
| Expel case study 4 | 2023, January | Publicly exposed Postman server with access key credentials stored in the project’s variables | N/A | (likely) AWS SES abuse (prevented) | [Incident report: stolen AWS access keys](https://expel.com/blog/incident-report-stolen-aws-access-keys/) |
| Cado Security and Invictus Incident Response | 2023, January | | N/A | | [Responding to an attack in AWS](https://awstip.com/responding-to-an-attack-in-aws-9048a1a551ac), [Part 2](https://awstip.com/responding-to-an-attack-in-aws-dae857806aa7) |
| AWS | 2023, February | Key disclosure, or SSRF | N/A | N/A |[The anatomy of ransomware event targeting data residing in Amazon S3](https://aws.amazon.com/blogs/security/anatomy-of-a-ransomware-event-targeting-data-in-amazon-s3/) |
| Sysdig | 2023, February | Exploit public facing k8s service | IAM creds in Lambda env vars and in S3 bucket | Data exfiltration | [SCARLETEEL: Operation leveraging Terraform, Kubernetes, and AWS for data theft](https://sysdig.com/blog/cloud-breach-terraform-data-theft/) |
| Invictus IR | 2023, April | exposed long-term credentials | CreateUser | data exfiltration and deletion with ransom note | [Ransomware in the cloud](https://invictus-ir.medium.com/ransomware-in-the-cloud-7f14805bbe82) |
| Unit 42 | 2023, April | sim-swap grants access to 10 access keys in source code | CreateUser with increased permissions | data exfiltration and deletion with ransom note | [From SIM-Swap to Data Leak on the Dark Web](https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/unit42-cloud-threat-report-volume7.pdf) |
| Unit 42 | 2023, April | SSRF via known CVE and IMDSv1 | Backdoored IAM role | Cryptojacking, outbound DDOS | [From Misconfigured Firewall to Cryptojacking Botnet](https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/unit42-cloud-threat-report-volume7.pdf) |
| Mitiga (RSAC) #1 | 2023, April | Company repository w/ AWS keys merged to personal github | N/A | N/A | [It’s Getting Real & Hitting the Fan: 2023 Edition](https://static.rainfocus.com/rsac/us23/sess/1664697541032001cak3/finalwebsite/2023_USA23_AIR-T02_01_It%E2%80%99s_Getting_Real__Hitting_the_Fan_2023_Edition_Real_World_SaaS_Attacks_1682607053333001zlzZ.pdf?_gl=1*trgj4t*_ga*MjAwODIwNzYxLjE2NzA0MzUzODQ.*_ga_Q3JZKF3KQM*MTY4MzYzODkzMS44My4xLjE2ODM2NDEwMTQuNTkuMC4w) |
| Mitiga (RSAC) #2 | 2023, April | Unknown root cause of access key compromise | N/A | Shared AMIs publicly for exfil | [It’s Getting Real & Hitting the Fan: 2023 Edition](https://static.rainfocus.com/rsac/us23/sess/1664697541032001cak3/finalwebsite/2023_USA23_AIR-T02_01_It%E2%80%99s_Getting_Real__Hitting_the_Fan_2023_Edition_Real_World_SaaS_Attacks_1682607053333001zlzZ.pdf?_gl=1*trgj4t*_ga*MjAwODIwNzYxLjE2NzA0MzUzODQ.*_ga_Q3JZKF3KQM*MTY4MzYzODkzMS44My4xLjE2ODM2NDEwMTQuNTkuMC4w) |
| Kroll #1 | 2023, April | Third party compromised | N/A | Redirect DNS and Email | [ Effective AWS Incident Response: Examples and Recommendations](https://www.kroll.com/en/insights/publications/cyber/effective-aws-incident-response) |
| Kroll #2 | 2023, April | Internal network compromised | Lateral movement into cloud, years of persistence | Data Exfiltration | [ Effective AWS Incident Response: Examples and Recommendations](https://www.kroll.com/en/insights/publications/cyber/effective-aws-incident-response) |
| S2W Talon "Donjuji" | 2023, May | Development server with exposed environment variables containing IAM user credentials | N/A | Stole data from S3 | [Detailed Analysis of CloudDon, Cloud Data Breach of Korea e-commerce company](https://medium.com/s2wblog/detailed-analysis-of-clouddon-cloud-data-breach-of-korea-e-commerce-company-948c3a5df90d) |
| Checkmarx | 2023, June | S3 bucket serving npm package bignum hijacked | N/A | Credential theft | [Hijacking S3 Buckets: New Attack Technique Exploited in the Wild by Supply Chain Attackers](https://checkmarx.com/blog/hijacking-s3-buckets-new-attack-technique-exploited-in-the-wild-by-supply-chain-attackers/) |
| SentinelOne | 2023, June | CVE-2022-47986 | N/A | N/A | [Anatomy of a Cloud Incident \| SentinelOne’s Vigilance vs. IceFire Ransomware](https://www.sentinelone.com/blog/anatomy-of-a-cloud-incident-sentinelones-vigilance-v-icefire-ransomware/) |
| Sysdig | 2023, July | Exploit public facing Jupyter Notebook in k8s | IAM creds, including via IMDSv2. Privilege escalation via IAM misconfiguration. Access key persistence | Cryptojacking | [SCARLETEEL 2.0: Fargate, Kubernetes, and Crypto](https://sysdig.com/blog/scarleteel-2-0/) |
| CrowdStrike | 2023, August | Exploiting RCE in a custom PHP web application | IAM creds, including via IMDS. Lateral movement via SSM | Unknown | [2023 Threat Hunting Report](https://go.crowdstrike.com/rs/281-OBQ-266/images/report-crowdstrike-2023-threat-hunting-report.pdf) |
| CrowdStrike | 2023, August | web application exploit | attempts to query IMDS and connect laterally | Unknown | [2023 Cloud Risk Report](https://www.dlt.com/sites/default/files/resource-attachments/2023-09/TDSPS_Oct2023_WS_2023_Cloud_risk_report.pdf) |
| Unit42 | 2023, August | Exploiting SugarCRM zero day | Access keys on EC2 hosts, Pacu + Scoutsuite scanning | DB data exfiltration | [When a Zero Day and Access Keys Collide in the Cloud: Responding to the SugarCRM Zero-Day Vulnerability](https://unit42.paloaltonetworks.com/sugarcrm-cloud-incident-black-hat/) |
| AWS | 2023, August | Compromise of federated user via unknown means | Access keys on EC2 hosts, Pacu + Scoutsuite scanning | DB data exfiltration | [Two real-life examples of why limiting permissions works: Lessons from AWS CIRT - Story 1: On the hunt for credentials](https://aws.amazon.com/blogs/security/two-real-life-examples-of-why-limiting-permissions-works-lessons-from-aws-cirt/) |
| AWS | 2023, August | RCE via unintentionally exposed port in ECS task definition | N/A | Cryptojacking | [Two real-life examples of why limiting permissions works: Lessons from AWS CIRT - Story 2: More instances for crypto mining](https://aws.amazon.com/blogs/security/two-real-life-examples-of-why-limiting-permissions-works-lessons-from-aws-cirt/) |
| Security Joes | 2023, Sep | Exploited a vulnerable version of MinIO on an AWS EC2 instance via [evil_minIO](https://github.com/AbelChe/evil_minio) | Network reconnaissance, create windows accounts | Unknown | [New Attack Vector In The Cloud: Attackers caught exploiting Object Storage Services](https://www.securityjoes.com/post/new-attack-vector-in-the-cloud-attackers-caught-exploiting-object-storage-services) |
| Unit42 | 2023, Oct | Credentials exposed on GitHub | Create EC2 instances | Monero Cryptojacking | [CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys](https://unit42.paloaltonetworks.com/malicious-operations-of-exposed-iam-keys-cryptojacking/) |
| Reliaquest | 2023, Nov | Spearphishing | Hijacked Citrix VDI | Data theft (lastpass export in S3 bucket) | [Scattered Spider Attack Analysis](https://www.reliaquest.com/blog/scattered-spider-attack-analysis-account-compromise/) |
| AWS CIRT | 2024, January | Third-party IdP compromise | Federated access to AWS environment | Data exfiltration | [How to investigate and respond to compromised third-party identity provider keys](https://aws.amazon.com/blogs/security/how-to-investigate-and-respond-to-compromised-third-party-identity-provider-keys/) |
| Datadog #1 | 2024, January | Leaked IAM User Key | created administrator IAM user | S3 data exfiltration, attempted cryptomining | [Tales from the cloud trenches: Amazon ECS is the new EC2 for crypto mining](https://securitylabs.datadoghq.com/articles/tales-from-the-cloud-trenches-ecs-crypto-mining/) |
| Datadog #2 | 2024, January | Leaked IAM User Key | N/A | Cryptomining (via ECS Fargate, XMRig) | [Tales from the cloud trenches: Amazon ECS is the new EC2 for crypto mining](https://securitylabs.datadoghq.com/articles/tales-from-the-cloud-trenches-ecs-crypto-mining/) |
| Invictus IR | 2024, January | Exposed IAM User (Administrator) Access Key | created administrator IAM user, added access keys for existing users, created externally assumable role | Cryptomining, SES spam/phishing, phishing infrastructure (domains) | [The curious case of DangerDev@protonmail.me](https://www.invictus-ir.com/news/the-curious-case-of-dangerdev-protonmail-me) |
| Stephen Berger (InfoGuardAG) | 2024, February | Unknown | N/A | S3 Ransomware (deleted buckets) | [AWS Ransomware](https://dfir.ch/posts/aws_ransomware/) |
| Sysdig | 2024, March | Exploited vulnerable Laravel + Wordpress | N/A | Meson CDN cryptomining | [Cloud Threats deploying Crypto CDN](https://sysdig.com/blog/cloud-threats-deploying-crypto-cdn/) |
| Datadog | 2024, March | Compromised Credentials | N/A | AWS SNS SMS Phishing | [Tales from the cloud trenches: Using malicious AWS activity to spot phishing campaigns](https://securitylabs.datadoghq.com/articles/tales-from-the-cloud-trenches-aws-activity-to-phishing/) |
| Mandiant | 2024, April | Phishing leads to compromise of credentials in former employee's personal Google Drive | N/A | S3 data exfiltration and "Ransomware" (deleted buckets) | [Cloud compromises: Lessons learned from Mandiant investigations in 2023 - Incident Response Case Study #4](https://assets.swoogo.com/uploads/3783545-66183eb421ec0.pdf) |
| Sysdig | 2024, May | Exploited known vulnerable Laravel (CVE-2021-3129) | N/A | LLMJacking | [LLMjacking: Stolen Cloud Credentials Used in New AI Attack](https://sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack/) |
| Lacework | 2024, June | Stolen or compromised credentials | Create new console user | LLMJacking | [Detecting AI resource-hijacking with Composite Alerts](https://www.lacework.com/blog/detecting-ai-resource-hijacking-with-composite-alerts) |
| Datadog | 2024, June | Stolen or compromised credentials | N/A | LLMJacking | [Tales from the cloud trenches: Raiding for AWS vaults, buckets and secrets](https://securitylabs.datadoghq.com/articles/tales-from-the-cloud-trenches-raiding-for-vaults-buckets-secrets/) |
| Yotam Meitar (Wiz) | 2024, June | Compromised vulnerable application (k8s Pod) | Exploit overprivileged secrets access to retrieve IDP-related credentials | S3 data exfiltration and "Ransomware" | [Responding to Sophisticated Ransom Attacks in the Cloud: A Real-World Case Study](https://www.youtube.com/watch?v=f066e7WndTQ) |
| Rapid7 #1 | 2024, July | Compromised credential | Create SES user and KMS key | Data Exfiltration & Distruction | [Cloud Attack Paths Unveiled: Lessons Learned from the SOC](https://2631050.fs1.hubspotusercontent-na1.net/hubfs/2631050/1108-24/Day%201%20-%20Presentations/Daniel%20Comarmond.pdf) |
| Rapid7 #2 | 2024, July | Compromised credential in public s3 | Create IAM users with SES access | SES Abuse | [Cloud Attack Paths Unveiled: Lessons Learned from the SOC](https://2631050.fs1.hubspotusercontent-na1.net/hubfs/2631050/1108-24/Day%201%20-%20Presentations/Daniel%20Comarmond.pdf) |
| Unit42 | 2024, August | Exposed AWS credentials | N/A | S3 data exfiltration and extortion | [Bling Libra’s Tactical Evolution: The Threat Actor Group Behind ShinyHunters Ransomware](https://unit42.paloaltonetworks.com/shinyhunters-ransomware-extortion/) |
| Wiz | 2024, September | Infostealer deployed via social engineering | VDP session hijack, RDP to server in cloud, extract AWS access keys | Data exfiltration | [Uncovering Hybrid Cloud Attacks Part 2 – The Attack](https://www.wiz.io/blog/uncovering-hybrid-cloud-attacks-part-2-the-attack) |
| Permiso | 2024, October | Stolen or compromised credentials | N/A | LLMJacking | [When AI Gets Hijacked: Exploiting Hosted Models for Dark Roleplaying](https://permiso.io/blog/exploiting-hosted-models) |
| Datadog | 2024, December | Stolen or compromised credentials | Create new role assumable by attacker account | Targeting SES | [Tales from the cloud trenches: Unwanted visitor](https://securitylabs.datadoghq.com/articles/tales-from-the-cloud-trenches-unwanted-visitor/#key-points-and-observations) |
| Wiz | 2024, December | Stolen or compromised credentials | Create new users and access keys | LLMJacking | [New Developments in LLM Hijacking Activity](https://www.wiz.io/blog/jinx-2401-llm-hijacking-aws) |
| Halcyon | 2025, January | Compromised AWS credentials | S3 SSE-C encryption abused for ransomware | Data encrypted for ransom | [Codefinger: S3 Ransomware](https://www.halcyon.ai/blog/abusing-aws-native-services-ransomware-encrypting-s3-buckets-with-sse-c) |
| Sygnia | 2025, January | Infostealer deployed via social engineering | Lambda PrivEsc to execute commands on EC2 instance | "API calls" to "critical assets" | [Sygnia’s 2025 Field Report](https://www.sygnia.co/blog/sygnia-2025-field-report-identity-based-attacks/) |
| Expel | 2025, February | Phishing/Smishing compromising Okta identities | N/A | N/A | [Expel's 2025 Annual Threat Report - Scattered Spider](https://expel.com/wp-content/uploads/2025/01/Expel-Annual-Threat-Report-2025-013025.pdf) |
| Badshah | 2025, April | Stolen or compromised credentials | N/A | Exfiltration and deletion | [Securing a SaaS Company's AWS Environment After a Breach](https://badshah.io/case-studies/saas-aws-breach/) |
| Mandiant M-Trends 2025 | 2025, April | Stolen or compromised credentials | N/A | Mining, LLMJacking, Resale | [M-Trends 2025: TRIPLESTRENGTH Leverages Stolen Credentials for Cloud Assets for Illicit Cryptocurrency Mining](https://services.google.com/fh/files/misc/m-trends-2025-en.pdf) |
| Datadog | 2025, March | Leaked credentials | Create Admin IAM Users, Lambda persistence, AWS SSO Persistence | N/A | [Tales from the cloud trenches: The Attacker doth persist too much, methinks](https://securitylabs.datadoghq.com/articles/tales-from-the-cloud-trenches-the-attacker-doth-persist-too-much/) |
| Darktrace #1 | 2025, July | Compromised credentials | RDP connections to other instances | Data Exfiltration | [Defending the Cloud: Stopping Cyber Threats in Azure and AWS with Darktrace](https://www.darktrace.com/blog/defending-the-cloud-stopping-cyber-threats-in-azure-and-aws-with-darktrace) |
| Darktrace #2 | 2025, July | SonicWall | N/A | Data Exfiltration | [Defending the Cloud: Stopping Cyber Threats in Azure and AWS with Darktrace](https://www.darktrace.com/blog/defending-the-cloud-stopping-cyber-threats-in-azure-and-aws-with-darktrace) |
| Google Cloud Threat Horizons UNC4899 Case | 2025, July | Malware via job opportunity premise | Session cookie theft, CloudFront & S3 JS modification | Cryptocurrency theft | [GCAT Threat Horizons H2 2025](https://services.google.com/fh/files/misc/cloud_threat_horizons_report_h22025.pdf) |
| Google Cloud Threat Horizons UNC6426 Case | 2025, August | nx npm supply chain compromise (QUIETVAULT malware) | GitHub PAT theft, OIDC trust abuse, CloudFormation IAM escalation | S3 exfiltration, EC2/RDS termination, source code exposure | [Cloud Threat Horizons Report H1 2026](https://cloud.google.com/security/report/resources/cloud-threat-horizons-report-h1-2026) |
| Wiz | 2025, September | Stolen or compromised credentials | Exit SES sandbox via support | SES abuse for phishing | [From Compromised Keys to Phishing Campaigns: Inside a Cloud Email Service Takeover](https://www.wiz.io/blog/wiz-discovers-cloud-email-abuse-campaign) |
| Sysdig | 2025, November | Credentials exposed in public S3 buckets | Lambda code injection, IAM access key creation, backdoor admin user | LLMJacking, GPU instance provisioning | [AI-assisted cloud intrusion achieves admin access in 8 minutes](https://sysdig.com/blog/ai-assisted-cloud-intrusion-achieves-admin-access-in-8-minutes/) |
| Fortinet | 2026, May | Shai-Hulud worm via poisoned npm/PyPI packages (TeamPCP) | IMDS credential theft, IAM admin user creation, Redshift access | Redshift data breach, credential compromise | [From CI/CD to Cloud Data: How Shai-Hulud Persistence Leads to Redshift Breach](https://www.fortinet.com/blog/threat-research/from-ci-cd-to-cloud-data-how-shai-hulud-persistence-leads-to-redshift-breach) |
| Sygnia | 2026, June | Compromised internet-facing application credentials | IAM user creation, reverse shells, CI/CD pipeline modification, Secrets Manager/Parameter Store access | Data exfiltration from RDS, infrastructure control for extortion | [Inside an AI-Assisted Cloud Attack](https://www.sygnia.co/blog/inside-an-ai-assisted-cloud-attack/) |
| Darktrace | 2026, June | Internet-exposed SSH with weak credentials (LiteLLM-Proxy) | IAM CreateUser attempts, Bedrock InvokeModel attempts | Cryptomining (XMRig), potential LLMJacking | [When AI Infrastructure Becomes Part of the Attack Surface](https://www.darktrace.com/blog/when-ai-infrastructure-becomes-part-of-the-attack-surface) |
| Fortinet | 2026, September | Leaked long-lived IAM access key with AdministratorAccess | IAM user creation, AWS Marketplace model subscriptions (CreateAgreementRequest/AcceptAgreementRequest), Bedrock service-specific credentials | LLMJacking | [Someone Else Is Using Your AI](https://www.fortinet.com/blog/threat-research/someone-else-is-using-your-ai) |
---
<a class="anchor" id="1"></a> [Postmortem Culture: Learning from Failure](https://sre.google/sre-book/postmortem-culture/)
<a class="anchor" id="2"></a> _Note_: There have been numerous identified incidents of Magecart exploiting S3 Global Write - in [one review targeting "well over 17,000 domains"](https://web.archive.org/web/20210620145033/https://www.riskiq.com/blog/labs/magecart-amazon-s3-buckets/)