Skip to content
Start with Identity
Join free
Dataset · CC BY 4.0

Identity Breach Database

115 breaches disclosed from 2021 to 2026 where identity was the way in: stolen credentials, MFA that was missing or beaten, help desks talked into resets, stolen sessions and OAuth tokens, exposed secrets, and flaws in the identity systems themselves. Every record is sourced to the victim, a regulator, a filing or a named security firm. The patterns across all of them are in the Identity Breach Report 2026.

115
identity-driven breaches
19%
began with stolen credentials
38%
had no MFA on the abused account (where known)
25%
abused a non-human identity

115 of 115 incidents

YearIncidentInitial access
2026Stolen Microsoft 365 session tokens replayed into 79 organizationsPhishing (adversary-in-the-middle)
2026LiteLLM poisoned PyPI and Docker release traced to a leaked, never-revoked admin keyExposed secrets
2026Zeabur shared cluster breached with a non-expiring admin token and plaintext AWS keysExposed secrets
2026Stolen ConnectWise app credentials open Microsoft 365 tenants across MSP customers
Storm-0940, China-state aligned (per Microsoft); Huntress has not tied all activity to one operator
Third-party access
2026BeyondTrust Remote Support zero-day used to dump the appliance credential vault
Armory Castle (previously tracked as UNC5221), China-nexus, per Google Threat Intelligence and Mandiant reporting
Identity infrastructure vulnerability
2026Ivanti Connect Secure header-spoofing auth bypass exploited to harvest AD credentials
UTA0576 (Volexity)
Identity infrastructure vulnerability
2026Dexcom internal documents accessed after targeted vishingCredential phishing
2026GhostAction returns: hijacked GitHub accounts push secret-stealing workflows
GhostAction operators (unattributed)
Stolen credentials
2026ASOS customer data reached with an employee login obtained by impersonation
Xuanye (claimed)
Credential phishing
2026Danish CPR register queried through a private company's abused accessThird-party access
2026JadePuffer wipes Azure resources with compromised service principals
Storm-3168 (JadePuffer), per Microsoft
Exposed secrets
2026Password spraying across Chilean Microsoft 365 tenants lands on default-password service accounts
UNK_CondorFiltration (Proofpoint)
Password spraying
2026CrowdSec private repositories copied with a departing engineer's GitHub tokenOAuth token abuse
2026Hijacked AI coding assistant session spreads Shai-Hulud inside a SaaS providerSupply chain
2026N-able N-central authentication bypass used to reach managed customer networksIdentity infrastructure vulnerability
2026RingCentral customer data stolen after a social engineering attack
ShinyHunters (claimed)
Credential phishing
2026Chick-fil-A One loyalty accounts taken over by credential stuffingCredential stuffing
2026GlobalProtect authentication bypass used as a ransomware front door
Qilin (Spikey Scorpius) and INC (Tarnished Scorpius) ransomware affiliates, per Arctic Wolf and Unit 42
Identity infrastructure vulnerability
2026SimpleHelp RMM OIDC token forgery exploited for technician accessIdentity infrastructure vulnerability
2026FortiBleed campaign harvests credentials through FortiGate devicesCredential stuffing
2026FortiCloud SSO bypass hits FortiGates already patched for CVE-2025-59718Identity infrastructure vulnerability
2025FortiGate FortiCloud SSO SAML bypass used for admin logins and config theftIdentity infrastructure vulnerability
2025Mixpanel smishing breach exposes OpenAI API user dataCredential phishing
2025Shai-Hulud 2.0 npm worm exposes credentials in 25,000+ repositoriesSupply chain
2025Gainsight-published Salesforce app tokens abused against customer instances
ShinyHunters (claimed; linked by Google Threat Intelligence, per press)
OAuth token abuse
2025FortiWeb authentication bypass exploited to create rogue admin accountsIdentity infrastructure vulnerability
2025DoorDash user contact data taken after an employee was socially engineeredCredential phishing
2025Nikkei Slack workspace accessed with credentials stolen by malwareStolen credentials
2025University of Pennsylvania donor and alumni systems breached via identity impersonationCredential phishing
2025Shai-Hulud self-replicating npm worm steals maintainer tokensSupply chain
2025Nx s1ngularity npm compromise harvests developer secrets with AI CLIsSupply chain
2025Salesloft Drift OAuth tokens used to raid Salesforce tenants
UNC6395 (Google Threat Intelligence)
OAuth token abuse
2025Workday CRM contact data taken in a social engineering campaignCredential phishing
2025Cisco.com user profile data exported after a vishing callCredential phishing
2025Allianz Life customer data taken from a cloud CRM via social engineeringCredential phishing
2025Aflac network intrusion attributed to social engineeringCredential phishing
2025UNC6040 voice phishing campaign against Salesforce customers
UNC6040, with extortion by UNC6240, which claims the ShinyHunters name (Google Threat Intelligence)
Consent phishing
2025Coinbase customer data stolen through paid overseas support staffInsider misuse
2025Marks & Spencer ransomware attack via impersonation of a third-party user
DragonForce (claimed); widely linked to Scattered Spider
Help desk social engineering
2025tj-actions/changed-files GitHub Action compromise leaks CI secretsSupply chain
2025Commvault Metallic breach exposes Microsoft 365 app secrets
Unnamed nation-state actor (per Commvault)
Third-party access
2025Bybit cold-wallet theft via hijacked Safe{Wallet} developer AWS sessions
TraderTraitor (UNC4899), per the FBI and Mandiant
Session or token theft
2025PowerSchool SIS data theft through a compromised support-portal credentialStolen credentials
2024US Treasury workstations accessed through a stolen BeyondTrust Remote Support key
China state-sponsored APT (unnamed by Treasury)
Third-party access
2024Cyberhaven Chrome extension hijacked through OAuth consent phishingConsent phishing
2024Internet Archive user database theft and Zendesk token abuseExposed secrets
2024Disney Slack data theft using credentials stolen from an employee's personal computer
NullBulge (Ryan Mitchell Kramer)
Stolen credentials
2024AT&T call and text records stolen from its Snowflake workspaceStolen credentials
2024Authy phone numbers enumerated through an unauthenticated endpoint
ShinyHunters (claimed)
Identity infrastructure vulnerability
2024TeamViewer corporate IT intrusion via a compromised employee account
APT29 (Midnight Blizzard)
Stolen credentials
2024Neiman Marcus customer data stolen from its Snowflake accountStolen credentials
2024Advance Auto Parts job applicant data stolen from its Snowflake accountStolen credentials
2024New York Times source code stolen with an exposed GitHub credentialExposed secrets
2024Snowflake customer tenant extortion campaign (UNC5537)
UNC5537
Stolen credentials
2024Ticketmaster customer data stolen from its Snowflake accountStolen credentials
2024Dropbox Sign production breach via a compromised service accountStolen credentials
2024MITRE NERVE network breached via Ivanti zero-days and session hijackingIdentity infrastructure vulnerability
2024Cisco Duo SMS MFA logs stolen from a phished telephony providerThird-party access
2024Sisense breach exposing customer credentials, prompting a CISA alertExposed secrets
2024Roku account credential stuffing in two wavesCredential stuffing
2024Change Healthcare ransomware via a Citrix remote access portal without MFA
ALPHV/BlackCat affiliate
Stolen credentials
2024Cloudflare Atlassian intrusion with credentials left unrotated after the Okta breachStolen credentials
2024Midnight Blizzard password spray into Microsoft corporate email
Midnight Blizzard (APT29)
Password spraying
2023Comcast Xfinity customer data theft via Citrix BleedIdentity infrastructure vulnerability
2023Sumo Logic AWS account accessed with a compromised credentialStolen credentials
2023Boeing Distribution breached by LockBit via Citrix Bleed session hijacking
LockBit 3.0 affiliate
Identity infrastructure vulnerability
2023Okta customer support system breach and HAR-file session token theftStolen credentials
202323andMe credential stuffing and DNA Relatives data scrapingCredential stuffing
2023Microsoft AI research SAS token exposed 38 TB of internal data
Wiz Research (discovered)
Exposed secrets
2023Caesars Entertainment loyalty database theft via IT support vendor
Scattered Spider (UNC3944)
Help desk social engineering
2023Retool SMS phishing, deepfaked call and Google Authenticator cloud syncCredential phishing
2023MGM Resorts help desk social engineering and ransomware
Scattered Spider (UNC3944), with ALPHV/BlackCat ransomware
Help desk social engineering
2023Help desk resets of Okta super administrator MFA at multiple customersHelp desk social engineering
2023Clorox intrusion after outsourced help desk reset passwords and MFA
Scattered Spider
Help desk social engineering
2023Storm-0558 forged Microsoft tokens to read Exchange Online mail
Storm-0558
Identity infrastructure vulnerability
2023Chick-fil-A One account credential stuffingCredential stuffing
2023Reddit employee phished via cloned intranet gatewayCredential phishing
2023GitHub repositories cloned with a compromised machine-account tokenStolen credentials
2023PayPal account credential stuffing exposing tax dataCredential stuffing
2023Norton LifeLock account credential stuffing with Password Manager exposureCredential stuffing
2023Mailchimp internal support tool access via employee social engineeringCredential phishing
2023CircleCI engineer session token theft and customer secrets exposureSession or token theft
2022Slack private GitHub repositories downloaded with stolen employee tokensSession or token theft
2022Dropbox GitHub repositories stolen via CircleCI-themed phishingPhishing (adversary-in-the-middle)
2022Medibank breach via contractor credentials on VPN without MFA
Aleksandr Ermakov (REvil-linked, sanctioned)
Stolen credentials
2022Optus customer data breach via API with broken access controlsMisconfiguration
2022Uber breach via contractor password and MFA fatigue
LAPSUS$ (affiliated, per Uber)
MFA fatigue
20220ktapus SMS phishing campaign against Okta users
0ktapus (Scatter Swine), later linked to Scattered Spider
Credential phishing
2022DoorDash data access via phished third-party vendor credentials
0ktapus (linked by DoorDash to the Twilio campaign)
Third-party access
2022LastPass customer vault backup theft via engineer credentials and trusted device cookieStolen credentials
2022Signal account re-registration via Twilio support console
0ktapus (via Twilio compromise)
Third-party access
2022Mailchimp August 2022 support tool breach via phished credentialsCredential phishing
2022Cisco corporate network breach via synced credentials, vishing and MFA fatigue
Initial access broker linked to UNC2447, LAPSUS$ and Yanluowang (per Cisco Talos)
MFA fatigue
2022Twilio breach via SMS phishing of employees
0ktapus (Scatter Swine)
Credential phishing
2022AiTM phishing campaign against more than 10,000 Microsoft 365 organizationsPhishing (adversary-in-the-middle)
2022LAPSUS$ access to T-Mobile internal tools with stolen credentials
LAPSUS$
Stolen credentials
2022GitHub private repositories accessed with stolen Heroku and Travis CI OAuth tokensOAuth token abuse
2022Mailchimp April 2022 support tool breach via social engineeringCredential phishing
2022Cash App Investing reports downloaded by former employee
Former employee
Insider misuse
2022Ronin bridge theft via compromised validator keys
Lazarus Group
Stolen credentials
2022LAPSUS$ access to Okta support via Sitel engineer workstation
LAPSUS$
Third-party access
2022LAPSUS$ source code theft from Microsoft via a single compromised account
LAPSUS$ (DEV-0537)
Stolen credentials
2022Crypto.com unauthorized withdrawals bypassing 2FAIdentity infrastructure vulnerability
2021Robinhood customer data theft via phone social engineering of support employeeCredential phishing
2021Nobelium abuse of reseller delegated administrative privileges
Nobelium (APT29)
Third-party access
2021Coinbase account takeovers via SMS account recovery flawIdentity infrastructure vulnerability
2021Nobelium password spray campaign and Microsoft support agent compromise
Nobelium (APT29)
Password spraying
2021Electronic Arts source code theft via purchased Slack cookieSession or token theft
2021Colonial Pipeline ransomware via legacy VPN account
DarkSide
Stolen credentials
2021Pulse Connect Secure VPN exploitation and credential harvestingIdentity infrastructure vulnerability
2021Codecov Bash Uploader compromise via credential extracted from Docker imageExposed secrets
2021Verkada camera platform access via exposed admin credentialsExposed secrets
2021Malwarebytes email access via abused Microsoft 365 application
SolarWinds Orion threat actor (Nobelium)
OAuth token abuse
2021Mimecast Microsoft 365 connection certificate stolen by SolarWinds actor
SolarWinds Orion threat actor (Nobelium)
Supply chain
2021Ubiquiti data theft and extortion by insider with cloud admin credentials
Nickolas Sharp (former employee)
Insider misuse

Download and method

Download the full database as CSV or JSON. Inclusion rule: publicly disclosed since January 2021, with identity as the initial access path or the decisive step, confirmed by the victim or credible reporting. Unconfirmed attacker claims are excluded. Records affected across incidents with a disclosed figure total 445.9 million, counting each incident's own figure, so overlapping populations are counted more than once.

Keep exploring

About the database

What is the Identity Breach Database?
A free, sourced record of 115 breaches disclosed from 2021 to 2026 where identity was the initial access path or the decisive step. Each record classifies the initial access vector, the identity control that failed, MFA status, whether a non-human identity was abused, and links the primary sources.
What is the most common way attackers get in through identity?
In this database the most common initial access vector is stolen credentials (22 of 115 incidents), followed by credential phishing (18) and identity infrastructure vulnerability (16).
How often was MFA missing in identity breaches?
Of the 40 incidents where MFA status on the abused account is documented, MFA was not enforced in 15 (38%) and was present but bypassed in 25. Incidents with undisclosed MFA status are excluded from that ratio.
Can I use this data in my own research or article?
Yes. The database is licensed CC BY 4.0. Download the CSV or JSON, cite the record or the database page, and link back. Every record lists its primary sources so you can verify independently.