Breaches that exposed api keys

39 breaches

Hugging FaceAutonomous OpenAI agent breached Hugging Face and stole internal datasets and credentialsAI or modelAIUSJul 17AccentureHacking exposed source code, API keys and credentials and tokens.HackingTechIEUnverifiedJul 7KlueSupply chain exposed credentials and tokens, API keys, names, emails and messages.Supply chainTechCAJun 19JetBrains15 malicious AI assistant plugins stole developers' AI API keysSupply chainTechCZUnverifiedJun 16GitHubSupply chain exposed source code, credentials and tokens and API keys.Supply chainTechUSMay 20BraintrustAI evaluation startup's AWS account breach exposed stored customer AI API keysHackingAIUSMay 4SAPOfficial SAP npm packages trojanized to steal developer credentialsSupply chainTechDEUnverifiedApr 29CheckmarxSupply chain exposed credentials and tokens, API keys and source code.Supply chainTechILApr 26BitwardenSupply chain exposed credentials and tokens and API keys.Supply chainTechUSUnverifiedApr 23VercelBreach at AI app maker Context AI led to theft of Vercel customer credentialsSupply chainTechUSApr 19CiscoSupply chain exposed source code and API keys.Supply chainTechUSUnverifiedMar 31LiteLLMMalware slipped into popular LiteLLM AI gateway package stole developer credentialsSupply chainAIUSUnverifiedMar 24Aqua SecurityTrivy scanner releases and GitHub Actions hijacked to push credential stealerSupply chainTechILUnverifiedMar 21LexisNexis Legal & ProfessionalLexisNexis confirms breach via React2Shell flaw as FulcrumSec leaks filesHackingData brokersUSUnverifiedMar 3OOpenClawMore than 135,000 OpenClaw AI agent instances found exposed to the internetExposed dataAIUnverifiedFeb 9MoltbookVibe-coded AI agent social network exposed 1.5M API tokens and 35,000 emailsExposed dataAIUnverifiedFeb 2CClawHubOver 230 malicious OpenClaw skills pushed info-stealing malware to AI agent usersSupply chainAIUnverifiedFeb 2The Home DepotLeaked GitHub token exposed Home Depot internal systems for a yearExposed dataRetailUSUnverifiedDec 12, 2025Tata MotorsExposed AWS keys in Tata Motors portal left customer data openExposed dataManufacturingINUnverifiedOct 28, 2025Smithery.aiPath traversal in MCP hosting registry exposed admin token to 3,000+ hosted AI serversExposed dataAIUnverifiedOct 22, 2025CloudflareSupply chain exposed names, emails, phone numbers, API keys and credentials and tokens.Supply chainTechUSSep 2, 2025SalesloftStolen Drift AI chatbot OAuth tokens used to raid customer Salesforce instancesSupply chainTechUSUnverifiedAug 26, 2025Nxs1ngularity: malicious Nx npm releases used AI CLIs to hunt and leak developer secretsSupply chainTechUSAug 26, 2025xAIExposed data exposed API keys.Exposed dataAIUSUnverifiedMay 1, 2025Common CrawlNearly 12,000 live API keys and passwords found in AI training datasetExposed dataNonprofitUSUnverifiedFeb 28, 2025MicrosoftStorm-2139 used stolen customer credentials to hijack Azure OpenAI accountsCredential stuffingTechUSFeb 26, 2025OmniGPTHacker leaked 34M lines of OmniGPT AI chat logs and 30,000 user contactsHackingAIUSUnverifiedFeb 12, 2025DeepSeekUnauthenticated ClickHouse database exposed chat history and API secretsExposed dataAICNUnverifiedJan 29, 2025OpenAIArtists leaked early access to OpenAI's Sora video model on Hugging FaceInsiderAIUSUnverifiedNov 26, 2024SAPExposed data exposed credentials and tokens, API keys and training data.Exposed dataTechDEUnverifiedJul 17, 2024RabbitHardcoded API keys in Rabbit R1 code exposed users' AI assistant responsesExposed dataAIUSUnverifiedJun 26, 2024Hugging FaceUnauthorized access to Spaces platform exposed a subset of user secretsHackingAIUSMay 31, 2024Dropbox SignThreat actor accesses Dropbox Sign production environment and all user dataHackingTechUSMay 1, 2024SisenseHacking exposed credentials and tokens and API keys.HackingData brokersUSUnverifiedApr 11, 2024BMWMisconfigured BMW Azure storage bucket exposes private keys and internal dataExposed dataManufacturingDEUnverifiedFeb 14, 2024Mercedes-BenzExposed GitHub token gave unrestricted access to Mercedes-Benz source codeExposed dataManufacturingDEUnverifiedJan 26, 2024Hugging Face1,681 exposed Hugging Face API tokens gave write access to Meta Llama and other reposExposed dataAIUSUnverifiedDec 4, 2023JumpCloudNorth Korean hackers breach JumpCloud to target its cryptocurrency customersHackingTechUSJul 12, 2023DropboxPhishing attack lets hacker steal 130 Dropbox GitHub repositoriesPhishingTechUSUnverifiedNov 1, 2022