Attackers Can Ransom Amazon S3 Data With Customer-Provided Encryption Keys
Attack Surface Exposure · 4 sources · Updated 2mo ago · First seen Jan 1, 2026
Attackers who obtain AWS programmatic credentials with broad Amazon S3 permissions can overwrite objects using server-side encryption with customer-provided keys (SSE-C). The attackers control the AES-256 keys, which AWS does not store or recover; consequently, organizations cannot decrypt the replaced objects without the original attacker-held keys. The technique can be paired with a ransom note and a seven-day bucket lifecycle deletion policy, creating both an extortion mechanism and a risk of permanent data loss.
Organizations should collect Amazon S3 data events in AWS CloudTrail and alert on successful PutObject activity specifying SSE-C/AES256 encryption, especially where the behavior is new for an IAM principal or bucket. Defenses include enabling S3 versioning to preserve recoverable object versions, enforcing least-privilege IAM and restrictive bucket policies, and monitoring changes to lifecycle configurations. S3 default server-side encryption should be configured as appropriate, but it does not eliminate the risk from authorized requests that explicitly supply attacker-controlled SSE-C keys.
