AWS Data Breach: Lesson From 4 High Profile Breaches

Take a look at 4 high-profile AWS data breaches, their root causes, and the vulnerabilities that made them possible. Learn about strategies to secure your cloud infrastructure and protect against similar risks.

One of the top cloud computing platforms, Amazon Web Services (AWS), provides scalable and secure infrastructure to companies all over the world. It provides solutions for networking, computation, and data storage, making its importance on the internet indisputable.

But as AWS adoption increases, so do the risks of AWS data breaches, which can have disastrous effects on businesses. The necessity for effective AWS data protection strategies is made obvious by the fact that these breaches frequently result from incorrect configurations, unauthorized access, and inadequate security measures.

AWS data breaches are usually caused by a combination of technical vulnerabilities and human errors. One of the most common issues is misconfigurations of AWS services, such as leaving S3 buckets publicly accessible.

For instance, in 2017, Accenture accidentally exposed sensitive data due to improperly secured AWS S3 buckets, a mistake that could have allowed attackers to access internal credentials and encryption keys.

Another major cause is exposed credentials, such as AWS access keys inadvertently published in public repositories like GitHub.

In 2019, an attacker exploited Capital One’s AWS instance by leveraging a misconfigured web application firewall (WAF) and stolen credentials, resulting in a breach of over 100 million customer records.

Additionally, the lack of encryption for sensitive data stores makes it easier for cybercriminals to access personal information, such as social security numbers, work email addresses, and desk phone numbers.

Over the years, several high-profile AWS security breaches have demonstrated the devastating impact of poor security practices.

2019 – Capital One Breach

The Capital One breach was caused by a misconfigured WAF that allowed an attacker to exploit a server-side request forgery (SSRF) vulnerability. The attacker gained access to AWS instance metadata, obtaining temporary security credentials assigned to an IAM role. These credentials enabled the attacker to access sensitive data stored in S3 buckets, including over one hundred million customer records, social security numbers, and work email addresses.

2021 – Twitch Data Leak

In October 2021, Twitch, an Amazon-owned streaming platform, suffered a massive data leak exposing 125GB of sensitive information. The breach resulted from a server misconfiguration, which allowed public access to internal systems. Data exposed included source code for the Twitch platform, details of creator payouts, and proprietary internal tools.

2022 – Pegasus Data Breach

In May 2022, Pegasus Airlines suffered a data breach due to a misconfigured AWS S3 bucket. The breach exposed 6.5 terabytes of sensitive data, which included flight crew members’ personal information and operational details. Because the bucket was publicly accessible, attackers were able to download confidential files. This incident infers three AWS data protection needs: server-side encryption for S3 buckets, strict bucket policies to prevent public access, and AWS Config implementation to detect and fix misconfigurations in real time.

2025 – Codefinger Ransomware

In January 2025, a ransomware group known as Codefinger targeted AWS users by exploiting compromised AWS credentials. The attackers utilized AWS’s server-side encryption with customer-provided keys (SSE-C) to encrypt data stored in Amazon S3 buckets. By generating and supplying their own AES-256 encryption keys, which AWS does not retain, the attackers made it impossible for victims to decrypt their data without the attackers’ keys. Additionally, the attackers set lifecycle policies to delete the encrypted files within seven days, pressuring victims to pay the ransom promptly.

The consequences of an AWS data breach include direct financial losses, and companies often face severe reputational damage and compliance penalties.

Large Financial Losses

The cost of recovering from an AWS security breach can run into millions of dollars. For example, Capital One incurred over $150 million in breach-related expenses, including legal fees and fines.

Reputational Damage

An AWS breach erodes customer trust. The Capital One incident led to widespread criticism, causing long-term damage to the company’s reputation. Similarly, the exposure of amazon employee data in the MOVEit vulnerability raised concerns about AWS’s ability to protect sensitive information.

Compliance Penalties

Companies are required to follow data protection laws such as HIPAA, CCPA, and GDPR. Heavy fines can be incurred for failing to secure sensitive data, including personal information and social security numbers.

To protect against AWS security breaches, organizations need to implement a comprehensive security strategy.

Identity and Access Management

AWS’s IAM is a useful tool for securing access to cloud resources. Organizations should enforce the principle of least privilege (PoP), ensuring that users and applications have only the permissions they need. Multi-factor authentication (MFA) should be mandatory for all accounts to prevent unauthorized access.

Encryption and Regular Audits

Encrypting sensitive data stores ensures that even if data is accessed, it remains unusable to attackers. AWS provides tools like AWS Key Management Service (KMS) for managing encryption keys. Regular security audits and vulnerability assessments can help identify and fix AWS misconfigurations before they are exploited.

Education on Secure Coding

Human error is a common cause of AWS data breaches. Training development teams on secure coding practices can reduce the risk of introducing vulnerabilities. For instance, avoiding the inclusion of sensitive credentials in code and utilizing environment variables can prevent exposed credentials.

Protect your organization with BlackFog’s anti data exfiltration (ADX) technology. ADX prevents unauthorized data from leaving your network by blocking outbound connections to malicious servers and stopping attacks at the source.

It enhances your security posture by addressing modern threats like ransomware, unauthorized access, and insider threats, ensuring sensitive data stays within your control.

Find out how BlackFog’s ADX technology can secure your data.