What happened
- Palo Alto Networks Unit 42 described a campaign that scanned 230 million+ unique targets and hit 110,000 domains.
- It collected 90,000+ unique variables from exposed .env files, of which 7,000 were tied to cloud services and 1,500 to social-media accounts.
- The files exposed cleartext credentials, including AWS IAM keys, SaaS API keys, database credentials and social tokens.
- The attackers exfiltrated S3 data, deleted objects and left a ransom note.
Root cause, per the sources
Unit 42 states that the secrets were exposed due to victim misconfigurations, not cloud-provider vulnerabilities.
The exposure behind it
A .env file holds application secrets. If a web server serves it to anyone who requests the right URL, the secrets are public. The precondition is a publicly reachable configuration file, which can be checked from outside.
What PixelPrivate can check
Data Exposure checks
We look for publicly reachable .env, .git and backup files on your public hosts and report them, for example as "Environment file (.env) is publicly readable".
Learn moreWhat PixelPrivate cannot do
- PixelPrivate does not detect intrusions, fraud or active attacks. It performs passive external checks and reports exposures.
- We do not tell you whether a file was already fetched by someone else, or whether a secret was used. If a file was exposed, rotate the secrets.
- We cannot claim that PixelPrivate would have prevented this incident, and we do not claim that.
What to do this week
- Check that your web server does not serve .env, .git or backup files.
- Rotate any secret that was ever in a publicly reachable file.
- Keep secrets out of web roots and out of images and repositories where possible.
- Use least-privilege cloud keys so a leaked key has limited reach.
Sources
- Palo Alto Networks Unit 42, “Cloud-Based Extortion Operation (large-scale cloud extortion operation)”, Published Aug 15, 2024; updated Sep 3, 2024. https://unit42.paloaltonetworks.com/large-scale-cloud-extortion-operation/
Last reviewed 2026-10-06. Figures are quoted as reported by the cited source.
Related hypothetical scenarios
Questions about this incident
Was this caused by a cloud provider vulnerability?
No. Unit 42 states that the secrets were exposed due to victim misconfigurations, not cloud-provider vulnerabilities.
What data was taken?
Per Unit 42, attackers exfiltrated S3 data, deleted objects and left a ransom note.
Can PixelPrivate tell if my .env was already stolen?
No. It can show whether such a file is publicly reachable now. It does not detect intrusions.
