Tag: cloud misconfiguration
19 articles
Thousands of Leaked AWS Keys Remain Active
A recent scan by Truffle Security uncovered a staggering 9,300+ active AWS keys that were leaked online, including hundreds with full administrative rights, putting sensitive data at risk. These compromised keys were found across various public platforms, with a shocking 88% still authentic and vulnerable to exploitation.
AWS Security Quarantine Policy Falls Short Against Credential Abuse
Leaking AWS credentials can lead to a staggering 99% increase in your bill - but a recent finding by Truffle Security reveals that even AWS' Quarantine Policy may not be enough to stop the damage, with hundreds of leaked root keys still active. This alarming discovery highlights the urgent need for tighter security measures to prevent credential abuse.
Exposed AWS Keys Grant Attackers Full Corporate Account Control
Thousands of exposed AWS keys are still active, putting entire corporate accounts at risk of being hijacked by attackers - and a staggering 88% of re-verified keys were found to still grant access as recently as August 2026. This alarming vulnerability highlights the urgent need for tighter security measures to protect sensitive cloud data.
Azure Exfiltration Campaign Exposes 3.6 Million Records
A shocking data breach has hit major players like McDonald's and Gap Inc., with a hacker claiming to have made off with a staggering 3.6 million Azure account records, including 1.7 million sensitive employee records from McDonald's alone. The breach exposes names, emails, addresses, and more, serving as a stark reminder that traditional security perimeters just aren't enough.
Azure Breach Exposes 3.6 Million Records from Top Companies
A threat actor known as TheHatman is selling employee data from top companies like McDonald's and Tata Consultancy Services, allegedly stolen from Microsoft Azure tenants using compromised credentials. The stolen records total 3.6 million, with McDonald's alone accounting for 1.7 million employee records.
Google Cloud billing dispute escalates over $11,000 hijack charges
Developer Charles Jones was hit with a whopping $11,089.77 in Google Cloud charges after his account was hijacked, despite reporting the compromise and revoking the implicated keys. The unexpected charges, largely linked to Gemini image-generation models, left him stunned as his business doesn't even use such technology.
Google API Keys Remain Usable for 23 Minutes After Deletion
Deleting a Google API key doesn't mean it's immediately useless to hackers - in fact, our experiments show it can remain active for up to 23 minutes, allowing attackers to continue misusing it even after you've tried to revoke access.
Misconfiguration Exposes Azure AI Agent to Unauthorized Access
A single misconfiguration in Microsoft's Azure SRE Agent turned a troubleshooting tool into a live wiretap, potentially allowing outsiders to intercept sensitive conversations, commands, and credentials from other companies in real time. This alarming security flaw may have left organizations vulnerable to unauthorized access, with no digital trail to detect the breach.
French Football Federation Exclusive: Damaging Data Breach
Imagine names, birthdates and contact details for more than two million amateur players suddenly exposed — that’s the frightening possibility tied to a suspected breach at the French Football Federation. Players and parents should be on alert for phishing and scams while the federation works to lock down access and notify those affected.
Secure Cloud Workloads: Exclusive Best Practices at Scale
Dont let one wrong permission undo your cloud gains—learn the identity-first, Zero Trust practices top teams use to secure cloud workloads at scale. This practical guide delivers clear, scalable steps to balance speed, cost and risk.
Improve Collaboration: Best Must-Have Steps to Beat Fraud
When fraudsters thrive on delay, real-time intelligence sharing across banks, telcos, tech firms and government is the fastest way to stop them in their tracks. Getting there means practical steps, common standards and a culture that treats shared signals as the public good they are.
Automated Botnet Attacks Exclusive: Critical PHP, IoT Surge
Think of the internet as a house with unlocked doors—automated botnets are testing every handle, exploiting PHP flaws, IoT devices, and cloud misconfigurations to swell their ranks. If you run servers or smart devices, patch, change defaults, and lock things down now.
Toys R Us Canada Exclusive: Alarming Data Dump
Toys R Us Canada just warned customers that attackers accessed and posted a database — including names, purchases and possibly payment details — so check your accounts, enable alerts or two‑factor auth, and replace cards if needed. This breach also underscores a familiar, avoidable security problem that keeps putting shoppers at risk.
145,000 Healthcare Records Exposed Exclusive Severe Breach
Imagine your most private medical moments sitting on a public server — thats what happened when a misconfigured database left roughly 145,000 healthcare records exposed. Names, contact details and treatment notes were accessible online, raising urgent questions about who saw them and how to prevent the next breach.
145,000 Healthcare Records Exposed: Exclusive Critical Risk
145,000 healthcare records exposed — names, contacts and treatment notes left unprotected on the open internet thanks to a likely cloud misconfiguration. This isn’t just a data count: it opens the door to identity theft, reputational harm and costly regulatory fallout for patients and providers.
5M Records Exposed Exclusive: Severe Auto Insurance Leak
Heads up: an unsecured database exposed more than 5 million auto-insurance records—names, policy numbers, VINs and claims—available to anyone with a link. That makes drivers prime targets for phishing, fake claims and identity theft, and could spell major legal and reputational headaches for insurers.
5M Records Exposed: Exclusive Damaging Auto Insurance Leak
Imagine a stranger flipping through the policies that underwrite your life on the road: more than five million auto insurance records—names, policy numbers, VINs and claims—were left in an unsecured online database anyone could download. Heres what went wrong, whos at risk, and what you can do to protect yourself.
5M Records Exposed: Exclusive Alarming Auto Insurance Leak
Over 5 million auto insurance records — including names, policy numbers, VINs and claims histories — were left publicly accessible by a simple cloud misconfiguration, turning routine paperwork into a roadmap for fraud. Find out how it happened and what you can do now to protect your privacy.
Jingle Thief Exclusive: Alarming Gift Card Theft
Think gift cards are harmless holiday fun? Jingle Thief uses simple phishing and cloud misconfigurations to siphon stored value from retailers, turning promos into cash for criminals — shoppers and merchants need to wake up and tighten defenses.