←back to thread

Ask HN: Our AWS account got compromised after their outage

391 points kinj28 | 2 comments | 21 Oct 25 15:55 UTC | HN request time: 0s | source

Could there be any link between the two events?

Here is what happened:

Some 600 instances were spawned within 3 hours before AWS flagged it off and sent us a health event. There were numerous domains verified and we could see SES quota increase request was made.

We are still investigating the vulnerability at our end. our initial suspect list has 2 suspects. api key or console access where MFA wasn’t enabled.

Show context
kondro ◴[21 Oct 25 23:40 UTC] No.45663175[source]▶
us-east-1 is unimaginably large. The last public info I saw said it had 159 datacenters. I wouldn't be surprised if many millions of accounts are primarily located there.

While this could possibly be related to the downtime, I think this is probably an unfortunate case of coincidence.

replies(1): >>45664990 #
1. Scramblejams ◴[22 Oct 25 04:49 UTC] No.45664990[source]▶
159! Staggering. Got a source?
replies(1): >>45665209 #
2. kondro ◴[22 Oct 25 05:33 UTC] No.45665209[source]▶
Sorry, 158: https://baxtel.com/data-center/aws-us-east-n-virginia