Hundreds of leaked AWS keys give full control over corporate accounts

Developers inadvertently committed AWS access keys — many with administrator-level privileges — into public code repositories and datasets, where they remain active and exploitable. The core failure is a combination of poor secrets hygiene, lack of pre-commit scanning, and inadequate credential lifecycle management. Because these keys were never rotated or revoked after exposure, attackers retain persistent, full-control access to corporate AWS environments. This matters enormously: a single leaked admin key can lead to complete cloud account compromise, mass data exfiltration, ransomware deployment, or unauthorized compute abuse like cryptomining. The involvement of a major AI platform like Hugging Face highlights that even trusted, widely-used services can become unintentional vectors for credential leakage at scale.