Identity Breach Database · Threat actors
Threat actors behind identity breaches
6 groups linked to 27 of the 123 records in the Identity Breach Database, with how each one got in and which identity control failed. Attribution follows each record's sources, and claimed names are marked as claims.
| Group | Type | Incidents | Period | Top identity failure |
|---|---|---|---|---|
| Scattered Spider UNC3944, 0ktapus, Roasted 0ktapus | Extortion group | 8 | 2022-2025 | Identity lifecycle (4) |
| Midnight Blizzard (APT29) APT29, NOBELIUM, Cozy Bear | Nation-state | 6 | 2021-2024 | Authentication (2) |
| ShinyHunters UNC6040, UNC6240, Bling Libra | Extortion group | 5 | 2024-2026 | Authentication (3) |
| LAPSUS$ DEV-0537, Strawberry Tempest | Extortion group | 4 | 2022 | Authentication (3) |
| Lazarus Group and TraderTraitor TraderTraitor, UNC4899, Lazarus Group | Nation-state | 3 | 2022-2026 | Credential storage (1) |
| Storm-0558 | Nation-state | 1 | 2023 | Directory and trust (1) |
About threat actor attribution
- Which threat actor appears most often in identity breaches?
- In the Identity Breach Database, Scattered Spider is linked to the most incidents (8, disclosed 2022-2025), most often starting with help desk social engineering.
- How are breaches attributed to a threat actor here?
- Each breach record names the actor its sources name: the victim, a government agency, or a named security firm. A group page collects the records whose actor field matches that group or one of its tracked names. Where a name is only claimed by the attacker or reported by press, the record says so. 27 of 123 records (22%) are linked to one of these 6 groups; the rest are unattributed or tied to a single-incident actor.