10/16/2026
Researchers checked 10,616 Amazon Web Services access keys that had been exposed online and found 88% still worked. Hundreds gave full administrative access. A leaked key must be disabled or replaced. Deleting the file containing it isn't enough.
More than 9,300 Amazon Web Services (AWS) access keys publicly exposed between August 2022 and August 2026 are still active and valid.