What to do when an encryption key leaks: a response plan

When an encryption key leaks, stop using it for new data, revoke it, work out which data it protected, and re-encrypt that data under a new key. OWASP says disclosure of an encryption key can expose all the data it protected, and that you should have a recovery plan written and easy to reach.

First hour

OWASP's key management guidance says to revoke compromised keys promptly and stop using them to protect new data.

1. Declare an incident and name a lead.
2. Stop new use. Switch writers to a new key. Keep the old key available only for decrypt if you still need it to recover data.
3. Revoke or disable the leaked key in your key service or CA.
4. Preserve logs of key access before they roll over.
5. Find the leak path. Repository, build log, chat, backup, departing employee or compromised host.

Scope the damage

Use your key inventory. OWASP says the plan should include an inventory of all keys and their uses, and identification of data and signatures affected.

Questions to answer:

• Which data was encrypted under this key?
• Could the attacker also get the ciphertext? A key without data is far less dangerous.
• Was it a wrapping key or a data key? For a data key, rotation of the parent does not help. AWS states that key rotation will not mitigate the effect of a compromised data key.
• If it was a signing key or CA key, what could be forged? OWASP notes a CA key disclosure lets an adversary issue fraudulent certificates.

Fix it

• Re-encrypt affected data under a new key. OWASP's preferred approach after compromise is decrypt and re-encrypt, keeping retired keys for a limited time so old backups can be read.
• Re-wrap data keys when only a wrapping key leaked, remembering that this does not reset data key limits.
• Reissue certificates and distribute new key material where needed.
• Rotate related secrets such as API tokens that traveled with it.
• Check legal duties. Personal data exposure may trigger notification clocks. See the GDPR 72 hour clock.

What to write down in advance

From OWASP: who to notify and who performs recovery with contact details, the re-key method, an inventory of keys and uses, enforcement of revocation checking and monitoring of re-keying, and how to identify affected data.

Prevent the next one

Keep keys out of source code, build artifacts and plaintext. OWASP says to use a vault or secrets manager and an HSM or isolated cryptographic service. See secrets exposure steps.

Quick check

Safeguard's dependency scanning and asset discovery can help find where leaked components or systems sit, though key inventory is yours to maintain.

Sources

• OWASP Key Management Cheat Sheet
• OWASP Cryptographic Storage Cheat Sheet
• AWS KMS: Rotate AWS KMS keys

Last reviewed: 19 October 2026.