No, a leaked credential is a nothing event in a mass leak as far as expected loss goes.
You’re better off waiting and monitoring until you’re sure you can get back online if your service supports any kind of revenue.
You’re better off waiting and monitoring until you’re sure you can get back online if your service supports any kind of revenue.
It's a key to your creditcard. Your revenue will be wiped out if you get the AWS bill after hackers booted hundreds of GPU instances under your account, moved terabytes in your data-transfer budgetm, burned tens of thousands of CPU-minutes in github actions under your creditcard, or used thousands of $s worth of tokens with your AI provider.
If you architected things correctly, your root DB key should be useless without an additional compromise of an independent system.
Naturally "a stolen key" here means that the key has access to something worth stealing. And my point was that there's far more worth stealing than your users' private data which many companies don't value that much.
From Margin Call:
> It's just money; it's made up. Pieces of paper with pictures on it so we don't have to kill each other just to get something to eat.
Even if that were not absolutely wrong¹ these days², if your risk is mitigated by being one of millions the damage done if you are hit could still be so high that you can't afford to³ knowingly take that risk.
--------
[1] if the credentials can be easily linked to the relevant account, cycling through them to see what useful stuff can be accessed using which is not difficult to quickly automate
[2] if it were ever right
[3] or your customers can't afford for you to
Thankfully, they clarified they're in Europe, so GDPR prevents them from ignoring known leaked credentials, lest they have that to deal with, on top of the revenue loss they'll make when all of their customers eventually find out: "they ran leaked credentials knowing our data was at risk, but decided to suck it and see".