Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
In 2017, reporting said files belonging to the U.S. Army Intelligence and Security Command (INSCOM), including classified information, were stored in a publicly accessible Amazon S3 bucket. The available reports do not establish that the files were officially marked Top Secret, or that anyone accessed or exploited them. The incident was reported as an S3 access-control failure—not as proof that a password was bypassed.
What happened in the 2017 AWS S3 exposure?
On November 29, 2017, SecurityWeek reported that tens of gigabytes of files apparently belonging to INSCOM were in an unprotected S3 bucket. The report attributed the discovery details to UpGuard, whose director of cyber risk research, Chris Vickery, reportedly found the data on an AWS subdomain named “inscom” in late September. That discovery timing is reported by SecurityWeek, not independently confirmed by an incident record. SecurityWeek’s contemporaneous report is the available source for these details.
The report also said the bucket contained Invertix private keys and other information that could potentially have enabled access to contractor internal systems. It did not establish that the keys were used or that those systems were compromised.
Were the files officially classified Top Secret?
The contemporaneous incident reporting supports the description “classified information,” but does not establish that the files carried an official Top Secret marking. The CSO Online item indexed on November 29, 2017 used “Top secret” in its headline, but the original page was not accessible and its headline alone does not verify the files’ markings. CSO Online’s indexed article should therefore not be treated as confirmation of a specific classification level.
#1 Best Overall
A separate AWS announcement about a Secret Region on November 20, 2017 is unrelated context. It does not show that this incident involved that region or Top Secret information. AWS’s announcement concerned the region, not the exposed bucket.
What “without password protection” means for an S3 bucket
S3 access is governed by permissions rather than by a single password prompt. A bucket can be exposed when its effective access controls permit public requests—for example, through a permissive bucket policy or an access control list (ACL). “Publicly accessible” describes what the permissions allowed; it does not establish that a malicious party actually retrieved the files.
For this incident, the available sources do not establish exploitation or unauthorized access. Exposure is serious because it can make data available to anyone who can reach it, but confirming whether anyone did so requires separate evidence such as access logs and incident investigation.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11How to prevent public access to S3
AWS says new buckets, access points, and objects do not allow public access by default. Administrators still need to review the effective permissions and prevent later configuration changes from making data public. AWS recommends enabling all four S3 Block Public Access settings at account and bucket levels where appropriate; the most restrictive applicable combination governs. Check application and sharing requirements before applying controls, then test intended access and explicitly grant the required principals. AWS: Blocking public access to Amazon S3 storage.
Review policies and ACLs
- Inspect bucket policies for wildcard principals such as
"Principal": "*"and broad wildcard actions that could permit public access. - Review ACL grants for “Everyone” or “Any authenticated AWS user.”
- Use IAM Access Analyzer for S3 and AWS Config managed rules to identify public-read or public-write conditions. AWS’s S3 security best practices describe these checks.
Monitor for exposure and investigate findings
AWS Security Hub guidance includes findings for S3 exposure and recommends investigating the affected bucket, its permissions, and any sensitive-data findings. GuardDuty can report policy or ACL changes that make a bucket public. A disabled Block Public Access setting is a reason to audit the configuration, not proof on its own that the bucket is publicly accessible; assess the effective permissions. See AWS Security Hub S3 controls and GuardDuty S3 finding types.
Quick Recap
Best Value
- Used Book in Good Condition
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
