221,000 Leaked Keys & a Pharma Giant Breached: This Week's Wake-Up Call 🔑

Two stories this week are a stark reminder that your data is often only as safe as the third parties and platforms that touch it. One exposed hundreds of thousands of live passwords hiding in plain sight; the other saw a pharmaceutical giant lose sensitive patient health records through a cloud partner.

🔑 The Internet's Biggest AI Dataset Was Leaking 221,000 Live Passwords

Researchers at Truffle Security scanned 7.6 petabytes of public AI training data on Hugging Face — one of the most popular platforms for sharing machine-learning datasets — and found a jaw-dropping 221,303 working credentials sitting out in the open. These weren't old, expired keys: they were live logins to cloud accounts, databases, and services, including keys that could rack up an estimated $920,000 a year in abuse if criminals used them.

Why should you care? Because this is how modern breaches start. When developers accidentally paste a password or API key into code or data that later gets scraped and republished, attackers can quietly walk right in. If your company builds with AI or shares data online, the lesson is simple: scan for secrets before you publish, and treat any exposed key as already compromised.

Read more

☁️ Amgen Breach Exposes Patient Health Data Through a Cloud Vendor

Pharmaceutical heavyweight Amgen confirmed that attackers stole sensitive information — including protected patient health data and proprietary company info — after breaking in through a third-party cloud provider. The company says it's still working out the full scope of what was taken.

This one matters because it hits two nerves at once: personal medical privacy and the growing risk of trusting outside vendors with your most sensitive data. You can lock down your own systems perfectly and still get burned if a partner's cloud is weak. For any business, it's a prompt to ask a hard question: do you actually know how well your vendors protect the data you hand them?

Read more

Stay ahead of threats with GOCO Security at gocosecurity.com.