Leaked Private Keys Expose 2,600+ Active HTTPS Certificates to Real-World Attacks

A collaborative study by GitGuardian and Google reveals the first Internet-scale analysis of private key leaks, mapping over 40,000 leaked keys to 140,000 real TLS certificates. As of September 2025, 2,600+ valid certificates remain exposed across Fortune 500 companies, healthcare, and government agencies, enabling attackers to impersonate websites or intercept encrypted communications. The alarming 9% response rate to security disclosures exposes widespread organizational misunderstanding of private key risks.