Skip to content
Start with Identity
Join free
Threat actor · Extortion group · MITRE ATT&CK G1004

LAPSUS$ identity breaches

LAPSUS$ is a cybercriminal group that MITRE ATT&CK tracks as G1004 and describes as active since at least mid-2021. Microsoft tracked it as DEV-0537 and described a pure extortion and destruction model that did not deploy ransomware. Almost every way in that Microsoft documented was an identity attack: the Redline infostealer, credentials and session tokens bought on criminal forums, payments to employees, suppliers or partners for credentials and MFA approval, SIM swapping, repeated MFA prompts, calls to the help desk to reset privileged accounts, and searches of public code repositories for exposed credentials. Microsoft reports the group targeted IT services and support providers to reach their customers. Uber attributed its 2022 breach to an attacker affiliated with LAPSUS$. The 2022 Cisco intrusion is not counted here: Cisco Talos tied that initial access broker to LAPSUS$ and other groups without attributing it to LAPSUS$.

Also tracked as
DEV-0537, Strawberry Tempest
Origin (as attributed)
Cybercriminal group (MITRE ATT&CK); no state attribution
MITRE ATT&CK
G1004
Profile verified
Nov 5, 2026
4
incidents in the database, disclosed 2022
1 / 0
MFA bypassed / not enforced (3 not applicable or undisclosed)
50%
began with stolen credentials
4 / 0
human / non-human identity abused

Incidents attributed to LAPSUS$

Records whose sources attribute the intrusion to this group or one of its tracked names, newest disclosure first. Each record links its primary sources.

Browse the full database

Identity techniques used

Identity controls that failed

How to defend against LAPSUS$

One control per initial access vector seen in this group's records, most frequent first. The identity lesson on each incident page gives the case-specific detail.

  1. Stolen credentials (2 of 4): Assume passwords leak: enforce phishing-resistant MFA on every account, watch for infostealer exposure of employee credentials, and revoke sessions when a credential is reported stolen. See Infostealer credential harvesting and Infostealer.
  2. MFA fatigue (1 of 4): Turn off simple push approval: require number matching, rate-limit prompts, and alert on repeated denied pushes for one user. See MFA fatigue and Number matching.
  3. Third-party access (1 of 4): Give vendors and outsourced support only the access they need, for as long as they need it, and review delegated administrative rights regularly. See Least privilege, Just-in-time access and PAM.

Sources

  1. LAPSUS$, Group G1004
  2. DEV-0537 criminal actor targeting organizations for data exfiltration and destruction (Microsoft, 2022-03-22)
  3. Review of the Attacks Associated with Lapsus$ and Related Threat Groups (Cyber Safety Review Board)

Profile verified Nov 5, 2026 against the sources above. Incident attributions come from each record's own sources. Corrections: contact us.

Frequently asked questions

Which breaches has LAPSUS$ been linked to?
The Identity Breach Database attributes 4 identity breaches disclosed 2022 to LAPSUS$: Uber breach via contractor password and MFA fatigue (2022), LAPSUS$ access to T-Mobile internal tools with stolen credentials (2022), LAPSUS$ access to Okta support via Sitel engineer workstation (2022) and LAPSUS$ source code theft from Microsoft via a single compromised account (2022). Attribution follows each record's sources; where the actor name is only claimed, the record says so.
How does LAPSUS$ get initial access?
Across its 4 records, the initial access vectors were stolen credentials (2), mfa fatigue (1) and third-party access (1). The identity control that failed most often was authentication (3 of 4).
Did MFA stop LAPSUS$?
In 1 of 4 incidents MFA was present and bypassed, and in 0 it was not enforced on the abused account. In the remaining 3, MFA was not applicable (no interactive login, such as a stolen key or token) or its status was not disclosed. Every incident abused a human account.

Cite this page

SWI Community Team. (2026). LAPSUS$ identity breaches. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/actors/lapsus/

Part of the Identity Breach Database, free to reuse under CC BY 4.0. See all threat actors.