Amazon SES Fails to Enforce TLS 1.2 Encryption, Risking PHI Exposure
Event summary
- Paubox testing in Q2 2026 revealed Amazon SES delivers emails in plaintext despite claiming TLS 1.2 requirement.
- Amazon SES failed to block invalid certificates, exposing PHI to man-in-the-middle attacks.
- HHS proposed rule in December 2024 will make encryption in transit mandatory, creating compliance risks.
- Paubox conducted 14 controlled tests showing SES uses opportunistic TLS without enforcing minimum versions.
The big picture
Paubox's findings highlight a critical security flaw in Amazon SES that could soon become a compliance liability as HHS tightens encryption requirements. The issue underscores the broader challenge of maintaining data security in cloud services, particularly for regulated industries like healthcare. With over 8,000 organizations relying on Paubox for HIPAA-compliant email security, this revelation could accelerate demand for more robust encryption solutions.
What we're watching
- Regulatory Headwinds
- How HHS's upcoming mandatory encryption rule will impact Amazon SES users handling PHI.
- Market Response
- Whether healthcare organizations will migrate from Amazon SES to more secure alternatives.
- Technical Remediation
- The pace at which Amazon will address these security gaps in SES.