900+ Certificates Used by Fortune 500, Governments Exposed by Key Leaks

GitGuardian and Google analysis discovered massive leakage of private TLS keys posted to public code repositories: about one million unique keys since 2021 mapped to 140,000 certificates, with 2,622 still valid as of September 2025. More than 900 valid certificates protected high-value targets including Fortune 500 firms, healthcare providers, and government agencies; many owners could not be identified and disclosure efforts saw low engagement, forcing certificate authorities to intervene. Researchers recommend moving to single-use, automatically rotating keys to limit exposure.