In 2017, SC Media reported that more than 60,000 files linked to work for the National Geospatial-Intelligence Agency (NGA) were accessible on an unsecured Amazon server. The report said the files included passwords and SSH keys, but it did not definitively establish whether Booz Allen Hamilton or Metronome was responsible.
What was exposed?
SC Media reported that the exposed dataset contained more than 60,000 files associated with NGA work. It included passwords and SSH keys, alongside other information. The report described domain registrations and credentials in the dataset as pointing toward Booz Allen Hamilton or Metronome, while noting that security firm UpGuard could not definitively identify which contractor was responsible. SC Media’s 2017 account is the basis for these details.
As an Amazon Associate I earn from qualifying purchases.
Were the files classified?
An NGA spokesperson characterized the exposed information as sensitive but unclassified and said the affected credentials were revoked. Booz Allen said that neither it nor its client found classified data available in the impacted unclassified cloud environments. The company described the incident as an employee unintentionally leaving a key in an unclassified cloud environment; it said it secured the area, notified its client and began an investigation. These are statements reported at the time, not independent verification of every exposed file.
Were the passwords or SSH keys used?
The reporting raised a potential risk: passwords and SSH keys can, depending on where they work and whether they remain valid, provide a route to other systems. Security commentator Zohar Alon warned that the credentials might enable access to more sensitive systems. The report does not establish that anyone used them, accessed additional systems or caused a follow-on breach.
#1 Best Overall
How did the files become accessible?
The available reporting does not establish the exact technical path that made the files accessible or how long they were exposed. Booz Allen attributed the incident to an employee unintentionally leaving a key in an unclassified cloud environment, but the report does not provide a complete forensic account. It also does not conclusively identify whether Booz Allen or Metronome was responsible.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How can organizations reduce the risk of public S3 data?
Current AWS documentation describes layered controls for Amazon S3. These capabilities explain ways organizations can reduce exposure today; they do not show which controls were configured in this 2017 incident.
Block public access at the appropriate levels
Amazon S3 Block Public Access settings can be applied at the organization, account, bucket and access-point levels. They override policies and permissions that would otherwise allow public access. AWS recommends enabling all four settings when that is compatible with the application’s intended access.
Free tools Windows power users keep installed
One-click scans. No signup required.
Assess access and look for sensitive data
Amazon Macie can evaluate whether an S3 bucket is publicly accessible by considering Block Public Access settings, policies and access-control lists. Its sensitive-data discovery features can analyze selected S3 objects. Automated discovery uses representative-object sampling, so it is a discovery aid—not a guarantee that every object has been inspected. Results also depend on the configured scope and supported data.
Public-access blocking and sensitive-data discovery address different questions: whether access is public, and whether selected stored objects contain sensitive information. Neither capability, by itself, establishes that every storage risk has been eliminated.
Quick Recap
Best Value
- Used Book in Good Condition
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
