ISIT Security LabsIncident response training

FastCart · Production order archive on Amazon S3

S3 Data Destruction Investigation

Advanced35 minCloud Security / Data Security / Incident Response
Now: Case briefing. Read the ticket and environment first. Do not open logs until you know what you are looking for.

Ticket summary

On 25 March 2026 FastCart's data engineering team opened IR-2026-0325-026 after historical records in fastcart-order-archive began returning 404/NoSuchKey. Application triage found no faulty delete path. CloudTrail instead shows versioning being suspended immediately before a burst of object deletion by fastcart-webhook-exec-role—the same role involved in IR-2026-0321-021. No ransom note or extortion demand was found.

Four days earlier, IR-2026-0321-021 established that a malicious webhook invocation gained code execution in fastcart-order-webhook, used its execution role to read the order archive and payment-provider secret, and successfully published unapproved function version 43. The earlier ticket closed without removing that version or revoking the role's active sessions.

The supplied evidence shows normal archive reads, a policy change made through a deployment-role session originating from the persisted function, a fresh fastcart-webhook-exec-role session, a PutBucketVersioning request, and the deletion burst. Determine the scope and sequence without assuming every missing current key is permanently lost.

S3 versioning semantics are central. A delete in a versioning-suspended bucket removes a null version if one exists, but a named version created while versioning was Enabled remains as a noncurrent version behind a delete marker. Use the object-version inventory and timestamps to separate recoverable named versions from permanently removed null versions.