Researcher finds hundreds of exposed AWS EBS snapshots leaking sensitive customer data, like VPN configurations, passwords, and in some cases government data
How safe are your secrets? If you used Amazon's Elastic Block Storage snapshots, you might want to check your settings.
Context & Ripple Effects
This is the latest entry in a recurring pattern of cloud misconfiguration leaks rather than platform breaches: researchers previously found Box enterprise storage accounts exposing waterworks backdoor passwords and an unsecured AWS server hosting 100GB of US Army and NSA intelligence data. The difference here is the resource type — EBS snapshots are disk images, so exposure hands over entire volumes of customer systems, not just files.
Amazon has already conceded the point once on object storage: after similar S3 leak waves, it shipped default encryption and unencrypted-file warnings for S3 in 2017. EBS snapshots never got the equivalent treatment, leaving sharing settings to each customer.
First-order effects
- Organizations whose snapshots appear in the exposed set face immediate credential rotation — leaked VPN configurations and passwords mean live remote-access paths may need to be treated as compromised.
- AWS customers broadly get a new audit task: checking whether their own EBS snapshots are publicly shareable, since the finding shows the setting is commonly left open.
Second-order effects
- Cloud security vendors gain a concrete selling point for snapshot-scanning and posture-management tooling, the same market pull that followed the earlier S3 and Box leak disclosures.
- Enterprise buyers under pressure from their own auditors will demand secure-by-default snapshot settings from AWS, echoing how the 2017 S3 tools became table stakes.
Third-order effects
- If misconfigured-storage leaks keep recurring across S3, Box, and now EBS, the industry's shared-responsibility model drifts toward provider-enforced defaults — and eventually toward regulators treating public cloud exposure as a reportable failure class rather than a customer error.
The trend: Cloud providers are being pushed from opt-in security controls to enforced defaults as each new class of misconfigured storage — buckets, enterprise file shares, and now block-storage snapshots — produces its own leak wave.