A major international stock exchange inadvertently exposed production AWS credentials for its Splunk SOAR (Security Orchestration, Automation, and Response) system via an online code formatting tool (JSONFormatter/CodeBeautify). The credentials were saved in a publicly accessible shareable link, making them permanently searchable and exploitable by threat actors. This exposure risks compromising the exchange’s incident response capabilities, potentially allowing attackers to disrupt automated security operations, manipulate threat detection, or escalate privileges within the financial infrastructure.Researchers confirmed that such credentials are actively harvested by unknown actors, with unauthorized access attempts detected even after link expiration. The breach highlights systemic negligence in handling sensitive automation keys, which could enable financial fraud, market manipulation, or large-scale operational disruptions. Given the stock exchange’s role in global finance, the incident poses severe reputational damage and regulatory scrutiny, while also serving as a high-value target for state-sponsored or financially motivated cybercriminals.