Barracuda: an old cloud key opens the door to an attack
Barracuda explains an intrusion that began with an access key that remained active after an external project. The case puts the spotlight on revoking third-party permissions.
News summary
In an account published on 11 November, Barracuda described an intrusion into part of its cloud environment that began with a valid access key. According to the company, the key had been given to a supplier during an earlier project and was not revoked when the work ended. The company links its acquisition to the compromise of that supplier's development environment.
Barracuda places the observed activity between 1 and 2 November and describes movement across cloud accounts, stored secrets, repositories and Kubernetes clusters. This is the investigation published by the company itself, not independent confirmation of all its details. The announcement does not establish that every organisation using Barracuda was affected to the same extent.
The operational lesson is specific: ending a project also requires closing off its access. A technically valid credential can continue to provide entry long after the business need that justified its creation has disappeared. Reviewing only employee accounts leaves out keys for applications, suppliers and automation.
Source: Barracuda — 11 November 2026
What to check in your business
Link each access key to an owner, a project and a review date.
- Revoke external access when work ends and verify that legitimate applications continue to function.
- Review usage logs and permissions for secrets; prioritise temporary credentials where the platform and process allow.
Concepts mentioned in this article: Cloud
At Seintec, we work with you to review your systems' dependencies, access and continuity so you can prioritise improvements on an informed basis. Contact our team.
Contact SeintecRelated service
Cybersecurity
Protection to reduce risks and disruption.