Major Data Breach: AWS Hit by APT Attack, 120 Million Users Affected

Bad news from the cloud security front. AWS confirmed this week that its servers were breached by an APT (Advanced Persistent Threat) attack, with approximately 120 million users' registered emails, encrypted passwords, and some billing information stolen. This is one of the largest cloud service provider data breaches in recent years.

Incident Details

AWS issued a statement Tuesday evening, stating its security team discovered abnormal access patterns on September 8. Initial investigation revealed the attacker gained initial access through an unpatched third-party OAuth integration vulnerability, then moved laterally within the network for 72 consecutive days.

Leaked data includes:

• 120 million user email addresses
• 68 million encrypted passwords (bcrypt, not yet cracked)
• 23 million billing records (including some credit card last 4 digits)
• Enterprise names and service subscription information for 150,000 enterprise customers

Response Measures

AWS stated it has patched the vulnerability and forced password resets for all affected accounts. The company also announced two years of free credit monitoring services for each affected user.

Industry Impact

The incident has reignited broad discussion on cloud security. Regulatory agencies in multiple countries indicated they will launch investigations, while enterprise customers have begun reassessing multi-cloud strategies. Microsoft Azure and Google Cloud seized the opportunity to launch migration incentives, attempting to attract AWS customers.