DisasterLab
PlaybooksEncryption key lost or unusable
Datacritical45 minutes to prepare

Encryption key lost or unusable

Encrypted customer data, backups, or infrastructure cannot be decrypted because the required key is missing or inaccessible.

01DetectConfirm the signal
02ContainStop more damage
03RecoverRestore control
04VerifyProve it works

What do you need right now?

Prepare before it happensRecover from this now

Your preparation

0 of 0 safeguards ready
0%
Continue the prevention checklist
Incident worksheet

Make the next decision with evidence

Prevent further loss, identify every surviving key copy or wrapped version, and quantify exactly which data is unrecoverable.

EvidenceDecisionActionProof

Capture before evidence disappears

  • Record key ID, version, provider, region, aliases, wrapping hierarchy, policy, deletion state, rotation history, audit events, and last successful decrypt.
  • Inventory ciphertext by dataset, customer, backup, snapshot, object, database field, application version, and key version.
  • Protect key backups, HSM or KMS replicas, escrow, deployment secrets, memory images, old environments, and encrypted exports from cleanup.

Decisions that change the response

QuestionAct whenAction
Cancel deletion?The provider key is pending deletion and an authorized recovery window remains.Cancel through the controlled account, preserve logs, and investigate who scheduled it.
Restore data or key?A legitimate wrapped key or escrow copy exists with intact authorization and provenance.Recover into an isolated environment; never upload uncertain key material into production.

Proof that recovery worked

  • Representative ciphertext from every key version decrypts and passes integrity and business checks.
  • Key aliases, policies, backups, applications, and disaster recovery environments use the intended versions.
  • Unrecoverable data and customer impact are explicitly counted rather than described as unknown.

Controls to put in place

  • Use managed key versioning, delayed deletion, dual control, and protected audit logs.
  • Back up or replicate recoverable key material according to the threat model and test restoration.
  • Map every encrypted dataset and backup to key versions, owners, and retention dependencies.
Tabletop drill

Disable a nonproduction key version. Find its ciphertext inventory, recover through the approved key path, decrypt samples, rotate to a new version, and test an old backup.

Escalate when

Contact the key provider and cryptography or recovery specialists immediately; use counsel when customer data or contractual retention becomes permanently inaccessible.

What this means

Strong encryption has no bypass. If every valid copy of the key is gone, the protected data may be permanently unrecoverable.

Warning signs

  • Decryption fails after a deployment, rotation, restore, or account change.
  • The key-management service reports deletion, disablement, or denied access.
  • Backups restore but their encrypted content cannot be opened.
  • A key alias points to an unexpected version.

Recover now

First 15 minutes

  1. Stop key deletion timers and automated rotation jobs if safe.
  2. Preserve key IDs, versions, policies, audit logs, and exact errors.
  3. Check replicas, escrow, hardware tokens, and provider recovery windows.
  4. Do not overwrite encrypted data or metadata while testing recovery.

Today

  1. Restore access through the provider’s documented recovery mechanism.
  2. Test decryption on a copy before changing production key references.
  3. If recovery is impossible, establish the exact unrecoverable data scope.
  4. Communicate data loss honestly and obtain legal advice when customer data is affected.

Verify recovery

  • Representative current and backup records decrypt correctly.
  • The intended key version and policy are documented.
  • Recovery does not depend on one account or device.
  • Key deletion and rotation alerts reach an owner.

Prepare now

Access

  • Key administration and data decryption use separate least-privilege roles.

Backups and evidence

  • Recovery copies or escrow follow the threat model and are tested.
  • Backup restore tests include actual decryption.

Contacts and ownership

  • Every critical key has an owner, purpose, and recovery procedure.

Practice

  • A non-production key recovery and rotation drill has succeeded.

Common mistakes

  • Backing up ciphertext without proving keys can be recovered.
  • Deleting old keys immediately after rotation.
  • Changing aliases repeatedly while diagnosing.

Sources

Last reviewed July 19, 2026Guidance changes. Confirm provider-specific actions in the linked official sources.