{
  "meta": {
    "title": "Identity Breach Report 2026",
    "publisher": "Start with Identity",
    "report": "https://startwithidentity.com/reports/identity-breach-report-2026/",
    "database": "https://startwithidentity.com/breaches/incidents/",
    "license": "CC BY 4.0",
    "generated_by": "scripts/reports/identity-breach-report.mjs",
    "snapshot": "2026-10-31"
  },
  "totals": {
    "incidents": 115,
    "by_period": {
      "2021-2022": 33,
      "2023-2024": 39,
      "2025-2026": 43
    },
    "first_disclosed": "2021-01-11",
    "last_disclosed": "2026-10-22",
    "verified_range": [
      "2026-10-31",
      "2026-10-31"
    ],
    "sources_total": 234,
    "incidents_with_2plus_sources": 89,
    "countries": 13,
    "industries": 15,
    "with_teardown": 16,
    "with_cve": 10,
    "with_technique": 66,
    "human": 86,
    "human_by_period": {
      "2021-2022": 28,
      "2023-2024": 29,
      "2025-2026": 29
    }
  },
  "initial_access": {
    "stolen-credentials": {
      "total": 22,
      "total_pct": 19.1,
      "2021-2022": 6,
      "2021-2022_pct": 18.2,
      "2023-2024": 13,
      "2023-2024_pct": 33.3,
      "2025-2026": 3,
      "2025-2026_pct": 7
    },
    "phishing-credentials": {
      "total": 18,
      "total_pct": 15.7,
      "2021-2022": 5,
      "2021-2022_pct": 15.2,
      "2023-2024": 3,
      "2023-2024_pct": 7.7,
      "2025-2026": 10,
      "2025-2026_pct": 23.3
    },
    "identity-infra-vulnerability": {
      "total": 16,
      "total_pct": 13.9,
      "2021-2022": 3,
      "2021-2022_pct": 9.1,
      "2023-2024": 5,
      "2023-2024_pct": 12.8,
      "2025-2026": 8,
      "2025-2026_pct": 18.6
    },
    "exposed-secrets": {
      "total": 9,
      "total_pct": 7.8,
      "2021-2022": 2,
      "2021-2022_pct": 6.1,
      "2023-2024": 4,
      "2023-2024_pct": 10.3,
      "2025-2026": 3,
      "2025-2026_pct": 7
    },
    "third-party-access": {
      "total": 9,
      "total_pct": 7.8,
      "2021-2022": 4,
      "2021-2022_pct": 12.1,
      "2023-2024": 2,
      "2023-2024_pct": 5.1,
      "2025-2026": 3,
      "2025-2026_pct": 7
    },
    "credential-stuffing": {
      "total": 7,
      "total_pct": 6.1,
      "2021-2022": 0,
      "2021-2022_pct": 0,
      "2023-2024": 5,
      "2023-2024_pct": 12.8,
      "2025-2026": 2,
      "2025-2026_pct": 4.7
    },
    "supply-chain": {
      "total": 6,
      "total_pct": 5.2,
      "2021-2022": 1,
      "2021-2022_pct": 3,
      "2023-2024": 0,
      "2023-2024_pct": 0,
      "2025-2026": 5,
      "2025-2026_pct": 11.6
    },
    "help-desk-social-engineering": {
      "total": 5,
      "total_pct": 4.3,
      "2021-2022": 0,
      "2021-2022_pct": 0,
      "2023-2024": 4,
      "2023-2024_pct": 10.3,
      "2025-2026": 1,
      "2025-2026_pct": 2.3
    },
    "oauth-token-abuse": {
      "total": 5,
      "total_pct": 4.3,
      "2021-2022": 2,
      "2021-2022_pct": 6.1,
      "2023-2024": 0,
      "2023-2024_pct": 0,
      "2025-2026": 3,
      "2025-2026_pct": 7
    },
    "session-token-theft": {
      "total": 4,
      "total_pct": 3.5,
      "2021-2022": 2,
      "2021-2022_pct": 6.1,
      "2023-2024": 1,
      "2023-2024_pct": 2.6,
      "2025-2026": 1,
      "2025-2026_pct": 2.3
    },
    "insider-misuse": {
      "total": 3,
      "total_pct": 2.6,
      "2021-2022": 2,
      "2021-2022_pct": 6.1,
      "2023-2024": 0,
      "2023-2024_pct": 0,
      "2025-2026": 1,
      "2025-2026_pct": 2.3
    },
    "password-spraying": {
      "total": 3,
      "total_pct": 2.6,
      "2021-2022": 1,
      "2021-2022_pct": 3,
      "2023-2024": 1,
      "2023-2024_pct": 2.6,
      "2025-2026": 1,
      "2025-2026_pct": 2.3
    },
    "phishing-aitm": {
      "total": 3,
      "total_pct": 2.6,
      "2021-2022": 2,
      "2021-2022_pct": 6.1,
      "2023-2024": 0,
      "2023-2024_pct": 0,
      "2025-2026": 1,
      "2025-2026_pct": 2.3
    },
    "consent-phishing": {
      "total": 2,
      "total_pct": 1.7,
      "2021-2022": 0,
      "2021-2022_pct": 0,
      "2023-2024": 1,
      "2023-2024_pct": 2.6,
      "2025-2026": 1,
      "2025-2026_pct": 2.3
    },
    "mfa-fatigue": {
      "total": 2,
      "total_pct": 1.7,
      "2021-2022": 2,
      "2021-2022_pct": 6.1,
      "2023-2024": 0,
      "2023-2024_pct": 0,
      "2025-2026": 0,
      "2025-2026_pct": 0
    },
    "misconfiguration": {
      "total": 1,
      "total_pct": 0.9,
      "2021-2022": 1,
      "2021-2022_pct": 3,
      "2023-2024": 0,
      "2023-2024_pct": 0,
      "2025-2026": 0,
      "2025-2026_pct": 0
    }
  },
  "access_family": {
    "reused-or-stolen-passwords": {
      "total": 32,
      "total_pct": 27.8,
      "2021-2022": 7,
      "2021-2022_pct": 21.2,
      "2023-2024": 19,
      "2023-2024_pct": 48.7,
      "2025-2026": 6,
      "2025-2026_pct": 14
    },
    "social-engineering": {
      "total": 30,
      "total_pct": 26.1,
      "2021-2022": 9,
      "2021-2022_pct": 27.3,
      "2023-2024": 8,
      "2023-2024_pct": 20.5,
      "2025-2026": 13,
      "2025-2026_pct": 30.2
    },
    "tokens-keys-secrets": {
      "total": 18,
      "total_pct": 15.7,
      "2021-2022": 6,
      "2021-2022_pct": 18.2,
      "2023-2024": 5,
      "2023-2024_pct": 12.8,
      "2025-2026": 7,
      "2025-2026_pct": 16.3
    },
    "identity-infrastructure": {
      "total": 17,
      "total_pct": 14.8,
      "2021-2022": 4,
      "2021-2022_pct": 12.1,
      "2023-2024": 5,
      "2023-2024_pct": 12.8,
      "2025-2026": 8,
      "2025-2026_pct": 18.6
    },
    "third-party-and-supply-chain": {
      "total": 15,
      "total_pct": 13,
      "2021-2022": 5,
      "2021-2022_pct": 15.2,
      "2023-2024": 2,
      "2023-2024_pct": 5.1,
      "2025-2026": 8,
      "2025-2026_pct": 18.6
    },
    "insider": {
      "total": 3,
      "total_pct": 2.6,
      "2021-2022": 2,
      "2021-2022_pct": 6.1,
      "2023-2024": 0,
      "2023-2024_pct": 0,
      "2025-2026": 1,
      "2025-2026_pct": 2.3
    }
  },
  "access_family_human": {
    "social-engineering": {
      "total": 28,
      "total_pct": 32.6,
      "2021-2022": 9,
      "2021-2022_pct": 32.1,
      "2023-2024": 7,
      "2023-2024_pct": 24.1,
      "2025-2026": 12,
      "2025-2026_pct": 41.4
    },
    "reused-or-stolen-passwords": {
      "total": 26,
      "total_pct": 30.2,
      "2021-2022": 6,
      "2021-2022_pct": 21.4,
      "2023-2024": 15,
      "2023-2024_pct": 51.7,
      "2025-2026": 5,
      "2025-2026_pct": 17.2
    },
    "identity-infrastructure": {
      "total": 17,
      "total_pct": 19.8,
      "2021-2022": 4,
      "2021-2022_pct": 14.3,
      "2023-2024": 5,
      "2023-2024_pct": 17.2,
      "2025-2026": 8,
      "2025-2026_pct": 27.6
    },
    "third-party-and-supply-chain": {
      "total": 6,
      "total_pct": 7,
      "2021-2022": 4,
      "2021-2022_pct": 14.3,
      "2023-2024": 1,
      "2023-2024_pct": 3.4,
      "2025-2026": 1,
      "2025-2026_pct": 3.4
    },
    "tokens-keys-secrets": {
      "total": 6,
      "total_pct": 7,
      "2021-2022": 3,
      "2021-2022_pct": 10.7,
      "2023-2024": 1,
      "2023-2024_pct": 3.4,
      "2025-2026": 2,
      "2025-2026_pct": 6.9
    },
    "insider": {
      "total": 3,
      "total_pct": 3.5,
      "2021-2022": 2,
      "2021-2022_pct": 7.1,
      "2023-2024": 0,
      "2023-2024_pct": 0,
      "2025-2026": 1,
      "2025-2026_pct": 3.4
    }
  },
  "access_family_definitions": {
    "social-engineering": {
      "label": "Social engineering of a person (talk-past)",
      "members": [
        "help-desk-social-engineering",
        "phishing-credentials",
        "phishing-aitm",
        "consent-phishing",
        "mfa-fatigue",
        "sim-swap"
      ]
    },
    "reused-or-stolen-passwords": {
      "label": "Stolen, stuffed or sprayed passwords",
      "members": [
        "stolen-credentials",
        "credential-stuffing",
        "password-spraying"
      ]
    },
    "tokens-keys-secrets": {
      "label": "Stolen tokens, keys and exposed secrets",
      "members": [
        "session-token-theft",
        "oauth-token-abuse",
        "exposed-secrets"
      ]
    },
    "identity-infrastructure": {
      "label": "Flaws in identity infrastructure",
      "members": [
        "identity-infra-vulnerability",
        "misconfiguration"
      ]
    },
    "third-party-and-supply-chain": {
      "label": "Trusted third parties and software supply chain",
      "members": [
        "third-party-access",
        "supply-chain"
      ]
    },
    "insider": {
      "label": "Insider misuse",
      "members": [
        "insider-misuse"
      ]
    }
  },
  "hypotheses": {
    "help_desk_initial_access": {
      "2021-2022": {
        "count": 0,
        "of": 33,
        "pct": 0
      },
      "2023-2024": {
        "count": 4,
        "of": 39,
        "pct": 10.3
      },
      "2025-2026": {
        "count": 1,
        "of": 43,
        "pct": 2.3
      }
    },
    "voice_led": {
      "2021-2022": {
        "count": 2,
        "of": 33,
        "pct": 6.1
      },
      "2023-2024": {
        "count": 4,
        "of": 39,
        "pct": 10.3
      },
      "2025-2026": {
        "count": 4,
        "of": 43,
        "pct": 9.3
      }
    },
    "voice_led_ids": [
      "2021-robinhood-support-vishing",
      "2022-cisco-vishing-mfa-fatigue",
      "2023-okta-customer-help-desk-super-admin-takeover",
      "2023-clorox-help-desk-password-reset",
      "2023-mgm-resorts-help-desk-ransomware",
      "2023-retool-sms-phishing-authenticator-sync",
      "2025-unc6040-salesforce-vishing-campaign",
      "2025-cisco-crm-vishing",
      "2026-ringcentral-social-engineering",
      "2026-dexcom-targeted-vishing"
    ],
    "phone_or_help_desk": {
      "2021-2022": {
        "count": 2,
        "of": 33,
        "pct": 6.1
      },
      "2023-2024": {
        "count": 5,
        "of": 39,
        "pct": 12.8
      },
      "2025-2026": {
        "count": 5,
        "of": 43,
        "pct": 11.6
      }
    },
    "oauth_token_or_consent": {
      "2021-2022": {
        "count": 2,
        "of": 33,
        "pct": 6.1
      },
      "2023-2024": {
        "count": 1,
        "of": 39,
        "pct": 2.6
      },
      "2025-2026": {
        "count": 4,
        "of": 43,
        "pct": 9.3
      }
    },
    "mfa_fatigue": {
      "2021-2022": {
        "count": 2,
        "of": 33,
        "pct": 6.1
      },
      "2023-2024": {
        "count": 0,
        "of": 39,
        "pct": 0
      },
      "2025-2026": {
        "count": 0,
        "of": 43,
        "pct": 0
      }
    },
    "non_human": {
      "2021-2022": {
        "count": 5,
        "of": 33,
        "pct": 15.2
      },
      "2023-2024": {
        "count": 10,
        "of": 39,
        "pct": 25.6
      },
      "2025-2026": {
        "count": 14,
        "of": 43,
        "pct": 32.6
      }
    },
    "social_engineering_all": {
      "2021-2022": {
        "count": 9,
        "of": 33,
        "pct": 27.3
      },
      "2023-2024": {
        "count": 8,
        "of": 39,
        "pct": 20.5
      },
      "2025-2026": {
        "count": 13,
        "of": 43,
        "pct": 30.2
      }
    },
    "social_engineering_of_human": {
      "2021-2022": {
        "count": 9,
        "of": 28,
        "pct": 32.1
      },
      "2023-2024": {
        "count": 7,
        "of": 29,
        "pct": 24.1
      },
      "2025-2026": {
        "count": 12,
        "of": 29,
        "pct": 41.4
      }
    },
    "identity_infra_vulnerability": {
      "2021-2022": {
        "count": 3,
        "of": 33,
        "pct": 9.1
      },
      "2023-2024": {
        "count": 5,
        "of": 39,
        "pct": 12.8
      },
      "2025-2026": {
        "count": 8,
        "of": 43,
        "pct": 18.6
      }
    },
    "supply_chain": {
      "2021-2022": {
        "count": 1,
        "of": 33,
        "pct": 3
      },
      "2023-2024": {
        "count": 0,
        "of": 39,
        "pct": 0
      },
      "2025-2026": {
        "count": 5,
        "of": 43,
        "pct": 11.6
      }
    },
    "stolen_stuffed_sprayed_passwords": {
      "2021-2022": {
        "count": 7,
        "of": 33,
        "pct": 21.2
      },
      "2023-2024": {
        "count": 19,
        "of": 39,
        "pct": 48.7
      },
      "2025-2026": {
        "count": 6,
        "of": 43,
        "pct": 14
      }
    },
    "social_2025_2026_saas_data": {
      "count": 7,
      "of": 13,
      "ids": [
        "2025-unc6040-salesforce-vishing-campaign",
        "2025-allianz-life-crm-social-engineering",
        "2025-cisco-crm-vishing",
        "2025-workday-crm-social-engineering",
        "2025-mixpanel-smishing-openai-api-users",
        "2025-upenn-development-systems-social-engineering",
        "2026-asos-employee-credential-theft"
      ]
    }
  },
  "mfa": {
    "not-applicable": {
      "total": 38,
      "total_pct": 33,
      "2021-2022": 7,
      "2021-2022_pct": 21.2,
      "2023-2024": 11,
      "2023-2024_pct": 28.2,
      "2025-2026": 20,
      "2025-2026_pct": 46.5
    },
    "unknown": {
      "total": 37,
      "total_pct": 32.2,
      "2021-2022": 14,
      "2021-2022_pct": 42.4,
      "2023-2024": 6,
      "2023-2024_pct": 15.4,
      "2025-2026": 17,
      "2025-2026_pct": 39.5
    },
    "bypassed": {
      "total": 25,
      "total_pct": 21.7,
      "2021-2022": 10,
      "2021-2022_pct": 30.3,
      "2023-2024": 10,
      "2023-2024_pct": 25.6,
      "2025-2026": 5,
      "2025-2026_pct": 11.6
    },
    "absent": {
      "total": 15,
      "total_pct": 13,
      "2021-2022": 2,
      "2021-2022_pct": 6.1,
      "2023-2024": 12,
      "2023-2024_pct": 30.8,
      "2025-2026": 1,
      "2025-2026_pct": 2.3
    }
  },
  "mfa_known": {
    "known": 40,
    "absent": 15,
    "bypassed": 25,
    "bypassed_share_of_known": 62.5,
    "by_period": {
      "2021-2022": {
        "absent": 2,
        "bypassed": 10,
        "known": 12,
        "unknown": 14,
        "not_applicable": 7,
        "of": 33
      },
      "2023-2024": {
        "absent": 12,
        "bypassed": 10,
        "known": 22,
        "unknown": 6,
        "not_applicable": 11,
        "of": 39
      },
      "2025-2026": {
        "absent": 1,
        "bypassed": 5,
        "known": 6,
        "unknown": 17,
        "not_applicable": 20,
        "of": 43
      }
    },
    "human_unknown": 37
  },
  "mfa_bypass_methods": {
    "identity-infra-vulnerability": 8,
    "help-desk-social-engineering": 3,
    "phishing-aitm": 3,
    "phishing-credentials": 3,
    "session-token-theft": 3,
    "consent-phishing": 2,
    "mfa-fatigue": 2,
    "stolen-credentials": 1
  },
  "mfa_bypass_method_groups": {
    "Person handed over or approved access (phishing, push spam, help desk reset, consent)": 13,
    "Token or session stolen after MFA": 3,
    "Flaw in identity infrastructure skipped MFA": 8,
    "Stolen credentials plus trusted device cookie": 1
  },
  "mfa_absent_access": {
    "stolen-credentials": 8,
    "credential-stuffing": 5,
    "password-spraying": 2
  },
  "mfa_absent_regulatory": {
    "with_regulatory": 6,
    "of": 15,
    "regulator_cites_mfa": [
      "2023-paypal-credential-stuffing",
      "2023-23andme-credential-stuffing-dna-relatives"
    ]
  },
  "mfa_blind_zone": {
    "2021-2022": {
      "count": 7,
      "of": 33,
      "pct": 21.2
    },
    "2023-2024": {
      "count": 11,
      "of": 39,
      "pct": 28.2
    },
    "2025-2026": {
      "count": 20,
      "of": 43,
      "pct": 46.5
    }
  },
  "mfa_blind_zone_total": {
    "count": 38,
    "of": 115
  },
  "mfa_blind_zone_composition": {
    "2021-2022": {
      "non_human": 5,
      "human_no_login_step": 2
    },
    "2023-2024": {
      "non_human": 9,
      "human_no_login_step": 2
    },
    "2025-2026": {
      "non_human": 12,
      "human_no_login_step": 8
    }
  },
  "identity_failure": {
    "authentication": {
      "total": 51,
      "total_pct": 44.3,
      "2021-2022": 16,
      "2021-2022_pct": 48.5,
      "2023-2024": 17,
      "2023-2024_pct": 43.6,
      "2025-2026": 18,
      "2025-2026_pct": 41.9
    },
    "non-human-identity": {
      "total": 21,
      "total_pct": 18.3,
      "2021-2022": 5,
      "2021-2022_pct": 15.2,
      "2023-2024": 5,
      "2023-2024_pct": 12.8,
      "2025-2026": 11,
      "2025-2026_pct": 25.6
    },
    "session-and-tokens": {
      "total": 12,
      "total_pct": 10.4,
      "2021-2022": 3,
      "2021-2022_pct": 9.1,
      "2023-2024": 5,
      "2023-2024_pct": 12.8,
      "2025-2026": 4,
      "2025-2026_pct": 9.3
    },
    "credential-storage": {
      "total": 10,
      "total_pct": 8.7,
      "2021-2022": 1,
      "2021-2022_pct": 3,
      "2023-2024": 5,
      "2023-2024_pct": 12.8,
      "2025-2026": 4,
      "2025-2026_pct": 9.3
    },
    "authorization": {
      "total": 9,
      "total_pct": 7.8,
      "2021-2022": 6,
      "2021-2022_pct": 18.2,
      "2023-2024": 1,
      "2023-2024_pct": 2.6,
      "2025-2026": 2,
      "2025-2026_pct": 4.7
    },
    "identity-lifecycle": {
      "total": 9,
      "total_pct": 7.8,
      "2021-2022": 2,
      "2021-2022_pct": 6.1,
      "2023-2024": 5,
      "2023-2024_pct": 12.8,
      "2025-2026": 2,
      "2025-2026_pct": 4.7
    },
    "directory-and-trust": {
      "total": 3,
      "total_pct": 2.6,
      "2021-2022": 0,
      "2021-2022_pct": 0,
      "2023-2024": 1,
      "2023-2024_pct": 2.6,
      "2025-2026": 2,
      "2025-2026_pct": 4.7
    }
  },
  "non_human": {
    "total": 29,
    "of": 115,
    "pct": 25.2,
    "by_period": {
      "2021-2022": {
        "count": 5,
        "of": 33,
        "pct": 15.2
      },
      "2023-2024": {
        "count": 10,
        "of": 39,
        "pct": 25.6
      },
      "2025-2026": {
        "count": 14,
        "of": 43,
        "pct": 32.6
      }
    },
    "access": {
      "exposed-secrets": 8,
      "supply-chain": 6,
      "stolen-credentials": 5,
      "oauth-token-abuse": 4,
      "third-party-access": 3,
      "consent-phishing": 2,
      "password-spraying": 1
    },
    "failure": {
      "non-human-identity": 21,
      "credential-storage": 4,
      "authorization": 2,
      "session-and-tokens": 2
    },
    "actor_type": {
      "unknown": 18,
      "nation-state": 7,
      "extortion-group": 3,
      "researcher": 1
    },
    "nation_state_nh": {
      "count": 7,
      "of": 15
    },
    "ai_agent_ids": [
      "2025-nx-s1ngularity-npm-compromise",
      "2026-saas-provider-ai-coding-assistant-shai-hulud",
      "2026-jadepuffer-azure-service-principals",
      "2026-connectwise-cloud-backup-app-credential"
    ]
  },
  "actor_type": {
    "unknown": {
      "total": 48,
      "total_pct": 41.7,
      "2021-2022": 8,
      "2021-2022_pct": 24.2,
      "2023-2024": 13,
      "2023-2024_pct": 33.3,
      "2025-2026": 27,
      "2025-2026_pct": 62.8
    },
    "financially-motivated": {
      "total": 30,
      "total_pct": 26.1,
      "2021-2022": 11,
      "2021-2022_pct": 33.3,
      "2023-2024": 14,
      "2023-2024_pct": 35.9,
      "2025-2026": 5,
      "2025-2026_pct": 11.6
    },
    "extortion-group": {
      "total": 19,
      "total_pct": 16.5,
      "2021-2022": 7,
      "2021-2022_pct": 21.2,
      "2023-2024": 5,
      "2023-2024_pct": 12.8,
      "2025-2026": 7,
      "2025-2026_pct": 16.3
    },
    "nation-state": {
      "total": 15,
      "total_pct": 13,
      "2021-2022": 5,
      "2021-2022_pct": 15.2,
      "2023-2024": 6,
      "2023-2024_pct": 15.4,
      "2025-2026": 4,
      "2025-2026_pct": 9.3
    },
    "insider": {
      "total": 2,
      "total_pct": 1.7,
      "2021-2022": 2,
      "2021-2022_pct": 6.1,
      "2023-2024": 0,
      "2023-2024_pct": 0,
      "2025-2026": 0,
      "2025-2026_pct": 0
    },
    "researcher": {
      "total": 1,
      "total_pct": 0.9,
      "2021-2022": 0,
      "2021-2022_pct": 0,
      "2023-2024": 1,
      "2023-2024_pct": 2.6,
      "2025-2026": 0,
      "2025-2026_pct": 0
    }
  },
  "attribution": {
    "named": 46,
    "of": 115,
    "by_period": {
      "2021-2022": {
        "count": 18,
        "of": 33,
        "pct": 54.5
      },
      "2023-2024": {
        "count": 13,
        "of": 39,
        "pct": 33.3
      },
      "2025-2026": {
        "count": 15,
        "of": 43,
        "pct": 34.9
      }
    }
  },
  "actor_clusters": {
    "Scattered Spider and 0ktapus (UNC3944, Scatter Swine)": {
      "count": 8,
      "by_period": {
        "2021-2022": 4,
        "2023-2024": 3,
        "2025-2026": 1
      },
      "ids": [
        "2022-twilio-sms-phishing",
        "2022-signal-twilio-registration",
        "2022-0ktapus-phishing-campaign",
        "2022-doordash-vendor-phishing",
        "2023-clorox-help-desk-password-reset",
        "2023-mgm-resorts-help-desk-ransomware",
        "2023-caesars-it-vendor-social-engineering",
        "2025-marks-and-spencer-third-party-impersonation"
      ],
      "access": {
        "help-desk-social-engineering": 4,
        "phishing-credentials": 2,
        "third-party-access": 2
      },
      "hedged": [
        "2022-0ktapus-phishing-campaign",
        "2022-doordash-vendor-phishing",
        "2025-marks-and-spencer-third-party-impersonation"
      ]
    },
    "Midnight Blizzard, Nobelium, APT29": {
      "count": 6,
      "by_period": {
        "2021-2022": 4,
        "2023-2024": 2,
        "2025-2026": 0
      },
      "ids": [
        "2021-mimecast-certificate-compromise",
        "2021-malwarebytes-service-principal-abuse",
        "2021-nobelium-password-spray-support-agent",
        "2021-nobelium-delegated-admin-privileges",
        "2024-microsoft-midnight-blizzard-password-spray",
        "2024-teamviewer-apt29-employee-account"
      ],
      "access": {
        "password-spraying": 2,
        "oauth-token-abuse": 1,
        "stolen-credentials": 1,
        "supply-chain": 1,
        "third-party-access": 1
      },
      "hedged": []
    },
    "LAPSUS$ (DEV-0537)": {
      "count": 5,
      "by_period": {
        "2021-2022": 5,
        "2023-2024": 0,
        "2025-2026": 0
      },
      "ids": [
        "2022-okta-sitel-lapsus",
        "2022-microsoft-lapsus-account",
        "2022-t-mobile-lapsus-stolen-credentials",
        "2022-cisco-vishing-mfa-fatigue",
        "2022-uber-mfa-fatigue"
      ],
      "access": {
        "mfa-fatigue": 2,
        "stolen-credentials": 2,
        "third-party-access": 1
      },
      "hedged": [
        "2022-cisco-vishing-mfa-fatigue",
        "2022-uber-mfa-fatigue"
      ]
    },
    "ShinyHunters and UNC6040": {
      "count": 4,
      "by_period": {
        "2021-2022": 0,
        "2023-2024": 1,
        "2025-2026": 3
      },
      "ids": [
        "2024-twilio-authy-unauthenticated-endpoint",
        "2025-unc6040-salesforce-vishing-campaign",
        "2025-gainsight-salesforce-token-abuse",
        "2026-ringcentral-social-engineering"
      ],
      "access": {
        "consent-phishing": 1,
        "identity-infra-vulnerability": 1,
        "oauth-token-abuse": 1,
        "phishing-credentials": 1
      },
      "hedged": [
        "2024-twilio-authy-unauthenticated-endpoint",
        "2025-gainsight-salesforce-token-abuse",
        "2026-ringcentral-social-engineering"
      ]
    },
    "China-nexus actors (Storm-0558, Storm-0940, Armory Castle, Treasury intruder)": {
      "count": 4,
      "by_period": {
        "2021-2022": 0,
        "2023-2024": 2,
        "2025-2026": 2
      },
      "ids": [
        "2023-storm-0558-microsoft-signing-key-forgery",
        "2024-us-treasury-beyondtrust-api-key",
        "2026-beyondtrust-remote-support-armory-castle",
        "2026-connectwise-cloud-backup-app-credential"
      ],
      "access": {
        "identity-infra-vulnerability": 2,
        "third-party-access": 2
      },
      "hedged": []
    },
    "North Korea (Lazarus Group, TraderTraitor)": {
      "count": 2,
      "by_period": {
        "2021-2022": 1,
        "2023-2024": 0,
        "2025-2026": 1
      },
      "ids": [
        "2022-ronin-bridge-validator-keys",
        "2025-bybit-safe-wallet-aws-session-hijack"
      ],
      "access": {
        "session-token-theft": 1,
        "stolen-credentials": 1
      },
      "hedged": []
    }
  },
  "nation_state_access": {
    "reused-or-stolen-passwords": 5,
    "third-party-and-supply-chain": 5,
    "identity-infrastructure": 3,
    "tokens-keys-secrets": 2
  },
  "industry": {
    "technology": {
      "total": 40,
      "total_pct": 34.8,
      "2021-2022": 14,
      "2021-2022_pct": 42.4,
      "2023-2024": 11,
      "2023-2024_pct": 28.2,
      "2025-2026": 15,
      "2025-2026_pct": 34.9
    },
    "b2b-saas": {
      "total": 19,
      "total_pct": 16.5,
      "2021-2022": 4,
      "2021-2022_pct": 12.1,
      "2023-2024": 7,
      "2023-2024_pct": 17.9,
      "2025-2026": 8,
      "2025-2026_pct": 18.6
    },
    "cross-industry": {
      "total": 13,
      "total_pct": 11.3,
      "2021-2022": 4,
      "2021-2022_pct": 12.1,
      "2023-2024": 2,
      "2023-2024_pct": 5.1,
      "2025-2026": 7,
      "2025-2026_pct": 16.3
    },
    "retail-ecommerce": {
      "total": 8,
      "total_pct": 7,
      "2021-2022": 1,
      "2021-2022_pct": 3,
      "2023-2024": 3,
      "2023-2024_pct": 7.7,
      "2025-2026": 4,
      "2025-2026_pct": 9.3
    },
    "media-streaming": {
      "total": 6,
      "total_pct": 5.2,
      "2021-2022": 0,
      "2021-2022_pct": 0,
      "2023-2024": 5,
      "2023-2024_pct": 12.8,
      "2025-2026": 1,
      "2025-2026_pct": 2.3
    },
    "crypto-web3": {
      "total": 5,
      "total_pct": 4.3,
      "2021-2022": 3,
      "2021-2022_pct": 9.1,
      "2023-2024": 0,
      "2023-2024_pct": 0,
      "2025-2026": 2,
      "2025-2026_pct": 4.7
    },
    "telecom": {
      "total": 4,
      "total_pct": 3.5,
      "2021-2022": 2,
      "2021-2022_pct": 6.1,
      "2023-2024": 2,
      "2023-2024_pct": 5.1,
      "2025-2026": 0,
      "2025-2026_pct": 0
    },
    "financial-services": {
      "total": 3,
      "total_pct": 2.6,
      "2021-2022": 2,
      "2021-2022_pct": 6.1,
      "2023-2024": 1,
      "2023-2024_pct": 2.6,
      "2025-2026": 0,
      "2025-2026_pct": 0
    },
    "gaming": {
      "total": 3,
      "total_pct": 2.6,
      "2021-2022": 1,
      "2021-2022_pct": 3,
      "2023-2024": 2,
      "2023-2024_pct": 5.1,
      "2025-2026": 0,
      "2025-2026_pct": 0
    },
    "government": {
      "total": 3,
      "total_pct": 2.6,
      "2021-2022": 0,
      "2021-2022_pct": 0,
      "2023-2024": 2,
      "2023-2024_pct": 5.1,
      "2025-2026": 1,
      "2025-2026_pct": 2.3
    },
    "healthcare": {
      "total": 3,
      "total_pct": 2.6,
      "2021-2022": 0,
      "2021-2022_pct": 0,
      "2023-2024": 2,
      "2023-2024_pct": 5.1,
      "2025-2026": 1,
      "2025-2026_pct": 2.3
    },
    "insurance": {
      "total": 3,
      "total_pct": 2.6,
      "2021-2022": 1,
      "2021-2022_pct": 3,
      "2023-2024": 0,
      "2023-2024_pct": 0,
      "2025-2026": 2,
      "2025-2026_pct": 4.7
    },
    "education": {
      "total": 2,
      "total_pct": 1.7,
      "2021-2022": 0,
      "2021-2022_pct": 0,
      "2023-2024": 0,
      "2023-2024_pct": 0,
      "2025-2026": 2,
      "2025-2026_pct": 4.7
    },
    "manufacturing": {
      "total": 2,
      "total_pct": 1.7,
      "2021-2022": 0,
      "2021-2022_pct": 0,
      "2023-2024": 2,
      "2023-2024_pct": 5.1,
      "2025-2026": 0,
      "2025-2026_pct": 0
    },
    "energy-utilities": {
      "total": 1,
      "total_pct": 0.9,
      "2021-2022": 1,
      "2021-2022_pct": 3,
      "2023-2024": 0,
      "2023-2024_pct": 0,
      "2025-2026": 0,
      "2025-2026_pct": 0
    }
  },
  "industry_tech_plus_saas": {
    "2021-2022": {
      "count": 18,
      "of": 33,
      "pct": 54.5
    },
    "2023-2024": {
      "count": 18,
      "of": 39,
      "pct": 46.2
    },
    "2025-2026": {
      "count": 23,
      "of": 43,
      "pct": 53.5
    }
  },
  "industry_tech_plus_saas_total": {
    "count": 59,
    "of": 115
  },
  "blast_radius": {
    "multi_victim_records": {
      "count": 27,
      "of": 115,
      "by_period": {
        "2021-2022": {
          "count": 6,
          "of": 33,
          "pct": 18.2
        },
        "2023-2024": {
          "count": 2,
          "of": 39,
          "pct": 5.1
        },
        "2025-2026": {
          "count": 19,
          "of": 43,
          "pct": 44.2
        }
      }
    },
    "fanout": {
      "count": 19,
      "of": 115,
      "by_period": {
        "2021-2022": {
          "count": 6,
          "of": 33,
          "pct": 18.2
        },
        "2023-2024": {
          "count": 3,
          "of": 39,
          "pct": 7.7
        },
        "2025-2026": {
          "count": 10,
          "of": 43,
          "pct": 23.3
        }
      },
      "non_human": 14,
      "access": {
        "supply-chain": 5,
        "third-party-access": 4,
        "exposed-secrets": 3,
        "oauth-token-abuse": 3,
        "phishing-credentials": 2,
        "session-token-theft": 1,
        "stolen-credentials": 1
      },
      "table": [
        {
          "id": "2021-mimecast-certificate-compromise",
          "how": "one Microsoft 365 app certificate shared by Mimecast customers",
          "downstream": "Not published",
          "period": "2021-2022"
        },
        {
          "id": "2021-codecov-bash-uploader",
          "how": "one cloud storage credential, customer CI secrets",
          "downstream": "Not published",
          "period": "2021-2022"
        },
        {
          "id": "2021-nobelium-delegated-admin-privileges",
          "how": "reseller delegated admin into customer tenants",
          "downstream": "609 customers attacked through 14 compromised providers",
          "period": "2021-2022"
        },
        {
          "id": "2022-okta-sitel-lapsus",
          "how": "one support engineer workstation",
          "downstream": "2 tenants accessed, 366 potentially affected",
          "period": "2021-2022"
        },
        {
          "id": "2022-github-heroku-travis-oauth-tokens",
          "how": "one machine account token to integration OAuth tokens",
          "downstream": "Dozens of organizations",
          "period": "2021-2022"
        },
        {
          "id": "2022-twilio-sms-phishing",
          "how": "employee access to internal customer tools",
          "downstream": "209 customers and 93 Authy users",
          "period": "2021-2022"
        },
        {
          "id": "2023-circleci-engineer-session-token-theft",
          "how": "one engineer session, all customer secrets",
          "downstream": "Every customer told to rotate all secrets",
          "period": "2023-2024"
        },
        {
          "id": "2023-okta-support-system-har-session-tokens",
          "how": "one service account into the support case system",
          "downstream": "134 customers, sessions hijacked at 5",
          "period": "2023-2024"
        },
        {
          "id": "2024-sisense-gitlab-token-customer-credentials",
          "how": "hard-coded token to customer credentials",
          "downstream": "Not published",
          "period": "2023-2024"
        },
        {
          "id": "2025-tj-actions-changed-files-ci-secrets",
          "how": "one Action tag, every repository using it",
          "downstream": "Not published",
          "period": "2025-2026"
        },
        {
          "id": "2025-commvault-metallic-azure-app-secrets",
          "how": "app client secrets for a Microsoft 365 backup SaaS",
          "downstream": "A small number of customers",
          "period": "2025-2026"
        },
        {
          "id": "2025-salesloft-drift-oauth-token-theft",
          "how": "one integration, OAuth tokens into customer Salesforce",
          "downstream": "Numerous Salesforce instances",
          "period": "2025-2026"
        },
        {
          "id": "2025-gainsight-salesforce-token-abuse",
          "how": "one publisher, tokens into customer Salesforce",
          "downstream": "More than 200 potentially affected instances",
          "period": "2025-2026"
        },
        {
          "id": "2025-nx-s1ngularity-npm-compromise",
          "how": "one CI workflow, a package many developers install",
          "downstream": "Over a thousand valid GitHub tokens leaked",
          "period": "2025-2026"
        },
        {
          "id": "2025-shai-hulud-npm-worm",
          "how": "stolen npm tokens republish victims’ packages",
          "downstream": "More than 500 packages",
          "period": "2025-2026"
        },
        {
          "id": "2025-shai-hulud-2-npm-worm",
          "how": "second wave of the same worm",
          "downstream": "Over 25,000 repositories with leaked secrets",
          "period": "2025-2026"
        },
        {
          "id": "2025-mixpanel-smishing-openai-api-users",
          "how": "one analytics vendor, customer datasets",
          "downstream": "A limited number of customers, including OpenAI",
          "period": "2025-2026"
        },
        {
          "id": "2026-connectwise-cloud-backup-app-credential",
          "how": "one vendor app credential, Graph tokens in customer tenants",
          "downstream": "162 tenants confirmed, more than 2,250 attempted",
          "period": "2025-2026"
        },
        {
          "id": "2026-litellm-leaked-admin-key-poisoned-release",
          "how": "one leaked admin key, a poisoned release",
          "downstream": "Not published (release live about two hours)",
          "period": "2025-2026"
        }
      ]
    },
    "campaigns": [
      {
        "id": "2024-snowflake-customer-tenant-campaign",
        "scope": "about 165 Snowflake customer accounts"
      },
      {
        "id": "2025-unc6040-salesforce-vishing-campaign",
        "scope": "Salesforce customer organizations"
      },
      {
        "id": "2022-0ktapus-phishing-campaign",
        "scope": "more than 130 organizations"
      },
      {
        "id": "2022-microsoft-aitm-phishing-bec",
        "scope": "more than 10,000 organizations targeted"
      },
      {
        "id": "2026-microsoft-365-token-replay-79-orgs",
        "scope": "79 organizations"
      },
      {
        "id": "2026-teamfiltration-chile-service-accounts",
        "scope": "28 Microsoft 365 tenants"
      }
    ],
    "downstream_records": {
      "count": 8,
      "pairs": [
        {
          "downstream": "2022-signal-twilio-registration",
          "upstream": "2022-twilio-sms-phishing"
        },
        {
          "downstream": "2022-doordash-vendor-phishing",
          "upstream": "2022-0ktapus-phishing-campaign"
        },
        {
          "downstream": "2024-cloudflare-unrotated-okta-breach-credentials",
          "upstream": "2023-okta-support-system-har-session-tokens"
        },
        {
          "downstream": "2024-ticketmaster-snowflake-account",
          "upstream": "2024-snowflake-customer-tenant-campaign"
        },
        {
          "downstream": "2024-advance-auto-parts-snowflake-account",
          "upstream": "2024-snowflake-customer-tenant-campaign"
        },
        {
          "downstream": "2024-neiman-marcus-snowflake-account",
          "upstream": "2024-snowflake-customer-tenant-campaign"
        },
        {
          "downstream": "2024-att-snowflake-call-records",
          "upstream": "2024-snowflake-customer-tenant-campaign"
        },
        {
          "downstream": "2025-gainsight-salesforce-token-abuse",
          "upstream": "2025-salesloft-drift-oauth-token-theft"
        }
      ]
    },
    "snowflake_cluster": 5,
    "okta_support_cluster": 2,
    "shai_hulud_records": [
      "2025-shai-hulud-npm-worm",
      "2025-shai-hulud-2-npm-worm",
      "2026-saas-provider-ai-coding-assistant-shai-hulud"
    ],
    "third_party_access": {
      "2021-2022": {
        "count": 4,
        "of": 33,
        "pct": 12.1
      },
      "2023-2024": {
        "count": 2,
        "of": 39,
        "pct": 5.1
      },
      "2025-2026": {
        "count": 3,
        "of": 43,
        "pct": 7
      }
    }
  },
  "stale_credentials": {
    "count": 12,
    "of": 115,
    "by_period": {
      "2021-2022": {
        "count": 3,
        "of": 33,
        "pct": 9.1
      },
      "2023-2024": {
        "count": 4,
        "of": 39,
        "pct": 10.3
      },
      "2025-2026": {
        "count": 5,
        "of": 43,
        "pct": 11.6
      }
    },
    "ids": [
      {
        "id": "2021-colonial-pipeline-legacy-vpn",
        "why": "legacy VPN profile believed unused"
      },
      {
        "id": "2022-cash-app-former-employee",
        "why": "access used after employment ended"
      },
      {
        "id": "2022-ronin-bridge-validator-keys",
        "why": "validator allowlist never revoked"
      },
      {
        "id": "2024-microsoft-midnight-blizzard-password-spray",
        "why": "legacy test tenant account and OAuth app"
      },
      {
        "id": "2024-cloudflare-unrotated-okta-breach-credentials",
        "why": "credentials from the Okta breach never rotated"
      },
      {
        "id": "2024-snowflake-customer-tenant-campaign",
        "why": "infostealer credentials as old as 2020, not rotated"
      },
      {
        "id": "2024-internet-archive-exposed-gitlab-zendesk-tokens",
        "why": "Zendesk tokens not rotated"
      },
      {
        "id": "2025-powerschool-powersource-credential",
        "why": "same credential already used months earlier"
      },
      {
        "id": "2025-gainsight-salesforce-token-abuse",
        "why": "tokens taken in the earlier Salesloft Drift campaign"
      },
      {
        "id": "2026-crowdsec-departing-engineer-github-token",
        "why": "former employee’s still-valid OAuth token"
      },
      {
        "id": "2026-litellm-leaked-admin-key-poisoned-release",
        "why": "leaked key deleted but never revoked"
      },
      {
        "id": "2026-ghostaction-github-actions-secrets-wave",
        "why": "victims of the 2025 wave never rotated secrets"
      }
    ]
  },
  "records": {
    "with_value": 34,
    "of": 115,
    "by_period": {
      "2021-2022": 14,
      "2023-2024": 14,
      "2025-2026": 6
    },
    "non_person_units": [
      {
        "id": "2021-nobelium-password-spray-support-agent",
        "unit": "organizations",
        "value": 3
      },
      {
        "id": "2021-nobelium-delegated-admin-privileges",
        "unit": "organizations",
        "value": 14
      },
      {
        "id": "2022-okta-sitel-lapsus",
        "unit": "organizations",
        "value": 2
      },
      {
        "id": "2023-okta-support-system-har-session-tokens",
        "unit": "organizations",
        "value": 134
      },
      {
        "id": "2022-twilio-sms-phishing",
        "unit": "organizations",
        "value": 209
      },
      {
        "id": "2022-mailchimp-internal-tool-april",
        "unit": "business accounts",
        "value": 319
      },
      {
        "id": "2022-mailchimp-internal-tool-august",
        "unit": "business accounts",
        "value": 214
      },
      {
        "id": "2023-mailchimp-employee-social-engineering",
        "unit": "business accounts",
        "value": 133
      },
      {
        "id": "2023-retool-sms-phishing-authenticator-sync",
        "unit": "business accounts",
        "value": 27
      },
      {
        "id": "2022-0ktapus-phishing-campaign",
        "unit": "credential sets",
        "value": 9931
      }
    ],
    "people_or_accounts": {
      "count": 24,
      "median": 1453977,
      "sum_notifications": 445845093,
      "mfa_absent_share_of_notifications": 72.3,
      "top": [
        {
          "id": "2024-change-healthcare-citrix-no-mfa",
          "victim": "Change Healthcare (UnitedHealth Group)",
          "value": 192700000,
          "period": "2023-2024"
        },
        {
          "id": "2024-att-snowflake-call-records",
          "victim": "AT&T",
          "value": 110000000,
          "period": "2023-2024"
        },
        {
          "id": "2023-comcast-xfinity-citrix-bleed",
          "victim": "Comcast (Xfinity)",
          "value": 35879455,
          "period": "2023-2024"
        },
        {
          "id": "2024-internet-archive-exposed-gitlab-zendesk-tokens",
          "victim": "Internet Archive",
          "value": 31000000,
          "period": "2023-2024"
        },
        {
          "id": "2025-aflac-social-engineering",
          "victim": "Aflac",
          "value": 22650000,
          "period": "2025-2026"
        },
        {
          "id": "2022-medibank-contractor-credentials-vpn",
          "victim": "Medibank Private",
          "value": 9700000,
          "period": "2021-2022"
        },
        {
          "id": "2022-optus-unauthenticated-api",
          "victim": "Optus (Singtel Optus)",
          "value": 9500000,
          "period": "2021-2022"
        },
        {
          "id": "2026-denmark-cpr-register-access-abuse",
          "victim": "Danish Civil Registration System (CPR), via the access of Pays ApS",
          "value": 8800000,
          "period": "2025-2026"
        },
        {
          "id": "2022-cash-app-former-employee",
          "victim": "Block (Cash App Investing)",
          "value": 8200000,
          "period": "2021-2022"
        },
        {
          "id": "2021-robinhood-support-vishing",
          "victim": "Robinhood Markets",
          "value": 7000000,
          "period": "2021-2022"
        }
      ],
      "top2_share_of_sum": 67.9,
      "over_1m": 12,
      "over_100m": 2,
      "by_family": {
        "reused-or-stolen-passwords": 12,
        "identity-infrastructure": 4,
        "insider": 2,
        "social-engineering": 2,
        "third-party-and-supply-chain": 2,
        "tokens-keys-secrets": 2
      },
      "by_mfa": {
        "absent": {
          "count": 10,
          "sum": 322385294,
          "median": 1453977
        },
        "bypassed": {
          "count": 3,
          "sum": 35885938,
          "median": 6000
        },
        "unknown": {
          "count": 7,
          "sum": 46682590,
          "median": 7000000
        },
        "not-applicable": {
          "count": 4,
          "sum": 40891271,
          "median": 4910905
        }
      }
    },
    "null_for_non_human": {
      "count": 26,
      "of": 29
    }
  },
  "financial": {
    "with_usd_value": 10,
    "of": 115,
    "by_type": {
      "penalty or settlement": {
        "count": 3,
        "sum": 19950000,
        "ids": [
          "2021-verkada-super-admin-credentials",
          "2022-cash-app-former-employee",
          "2023-paypal-credential-stuffing"
        ]
      },
      "ransom paid": {
        "count": 1,
        "sum": 4400000,
        "ids": [
          "2021-colonial-pipeline-legacy-vpn"
        ]
      },
      "value stolen": {
        "count": 3,
        "sum": 2154000000,
        "ids": [
          "2022-crypto-com-2fa-bypass",
          "2022-ronin-bridge-validator-keys",
          "2025-bybit-safe-wallet-aws-session-hijack"
        ]
      },
      "company-reported cost": {
        "count": 3,
        "sum": 3170000000,
        "ids": [
          "2023-mgm-resorts-help-desk-ransomware",
          "2024-change-healthcare-citrix-no-mfa",
          "2024-advance-auto-parts-snowflake-account"
        ]
      }
    },
    "rows": [
      {
        "id": "2024-change-healthcare-citrix-no-mfa",
        "victim": "Change Healthcare (UnitedHealth Group)",
        "usd": 3067000000,
        "type": "company-reported cost"
      },
      {
        "id": "2025-bybit-safe-wallet-aws-session-hijack",
        "victim": "Bybit (through a compromise of Safe{Wallet})",
        "usd": 1500000000,
        "type": "value stolen"
      },
      {
        "id": "2022-ronin-bridge-validator-keys",
        "victim": "Sky Mavis (Ronin Network, Axie Infinity)",
        "usd": 620000000,
        "type": "value stolen"
      },
      {
        "id": "2023-mgm-resorts-help-desk-ransomware",
        "victim": "MGM Resorts International",
        "usd": 100000000,
        "type": "company-reported cost"
      },
      {
        "id": "2022-crypto-com-2fa-bypass",
        "victim": "Crypto.com",
        "usd": 34000000,
        "type": "value stolen"
      },
      {
        "id": "2022-cash-app-former-employee",
        "victim": "Block (Cash App Investing)",
        "usd": 15000000,
        "type": "penalty or settlement"
      },
      {
        "id": "2021-colonial-pipeline-legacy-vpn",
        "victim": "Colonial Pipeline Company",
        "usd": 4400000,
        "type": "ransom paid"
      },
      {
        "id": "2024-advance-auto-parts-snowflake-account",
        "victim": "Advance Auto Parts",
        "usd": 3000000,
        "type": "company-reported cost"
      },
      {
        "id": "2021-verkada-super-admin-credentials",
        "victim": "Verkada",
        "usd": 2950000,
        "type": "penalty or settlement"
      },
      {
        "id": "2023-paypal-credential-stuffing",
        "victim": "PayPal",
        "usd": 2000000,
        "type": "penalty or settlement"
      }
    ],
    "note_without_usd": [
      "2022-lastpass-vault-backup-theft",
      "2022-medibank-contractor-credentials-vpn",
      "2023-clorox-help-desk-password-reset",
      "2023-caesars-it-vendor-social-engineering",
      "2025-marks-and-spencer-third-party-impersonation",
      "2025-coinbase-paid-support-insiders"
    ],
    "change_healthcare_share_of_company_costs": 96.8,
    "company_cost_mfa": [
      {
        "id": "2023-mgm-resorts-help-desk-ransomware",
        "mfa": "bypassed",
        "access": "help-desk-social-engineering"
      },
      {
        "id": "2024-change-healthcare-citrix-no-mfa",
        "mfa": "absent",
        "access": "stolen-credentials"
      },
      {
        "id": "2024-advance-auto-parts-snowflake-account",
        "mfa": "absent",
        "access": "stolen-credentials"
      }
    ]
  },
  "regulatory": {
    "with_outcome": 20,
    "of": 115,
    "by_period": {
      "2021-2022": {
        "count": 9,
        "of": 33,
        "pct": 27.3
      },
      "2023-2024": {
        "count": 11,
        "of": 39,
        "pct": 28.2
      },
      "2025-2026": {
        "count": 0,
        "of": 43,
        "pct": 0
      }
    },
    "kinds": {
      "Fine or civil penalty imposed": 4,
      "Settlement (regulator or class action)": 3,
      "Criminal charges, plea, sentence or sanctions": 6,
      "Government directive, alert or review": 7,
      "Regulator or civil proceedings, pending": 3
    },
    "unclassified": [],
    "regulator_cites_mfa": [
      "2023-paypal-credential-stuffing",
      "2023-23andme-credential-stuffing-dna-relatives"
    ],
    "by_mfa": {
      "absent": 6,
      "bypassed": 5,
      "not-applicable": 5,
      "unknown": 4
    },
    "rate_mfa_absent": {
      "count": 6,
      "of": 15
    },
    "rate_mfa_bypassed": {
      "count": 5,
      "of": 25
    },
    "rate_other": {
      "count": 9,
      "of": 75
    },
    "outcome_lag_years": {
      "median": 2,
      "min": 0,
      "max": 3,
      "two_plus": 12,
      "of": 20
    }
  },
  "techniques": {
    "secrets-in-repositories-and-ci": 14,
    "infostealer-credential-harvesting": 10,
    "credential-stuffing": 8,
    "static-api-key-abuse": 8,
    "session-cookie-theft": 7,
    "help-desk-social-engineering": 6,
    "password-spraying": 5,
    "orphaned-account-abuse": 4,
    "token-replay-unbound-endpoint": 4,
    "aitm-phishing-proxy": 3,
    "oauth-consent-phishing": 3,
    "otp-relay-social-engineering": 3,
    "federation-trust-abuse-saml-forgery": 2,
    "mfa-fatigue-push-bombing": 2,
    "refresh-token-abuse": 2,
    "device-code-phishing": 1,
    "kerberoasting": 1
  },
  "vendor_surfaces": {
    "iam/microsoft-entra": 9,
    "iam/okta": 5,
    "pam/beyondtrust": 2,
    "mfa/google-authenticator": 1,
    "password-management/lastpass": 1,
    "zero-trust/palo-alto": 1
  },
  "cves": {
    "cve-2023-4966": 2,
    "cve-2023-46805": 1,
    "cve-2025-59718": 1,
    "cve-2025-64446": 1,
    "cve-2026-102764": 1,
    "cve-2026-104935": 1,
    "cve-2026-111357": 1,
    "cve-2026-18577": 1,
    "cve-2026-24858": 1,
    "cve-2026-48558": 1
  },
  "controls": {
    "ranked": [
      {
        "rank": 1,
        "key": "phishing-resistant-mfa",
        "label": "Phishing-resistant MFA (passkeys, FIDO2) for every human login",
        "rule": "Human identity, and the attacker got in by phishing, push spam, SIM swap, stuffing or spraying, or with a stolen password where MFA was absent",
        "count": 40,
        "pct": 34.8,
        "by_period": {
          "2021-2022": 12,
          "2023-2024": 15,
          "2025-2026": 13
        },
        "ids": [
          "2021-colonial-pipeline-legacy-vpn",
          "2021-nobelium-password-spray-support-agent",
          "2021-robinhood-support-vishing",
          "2022-mailchimp-internal-tool-april",
          "2022-microsoft-aitm-phishing-bec",
          "2022-twilio-sms-phishing",
          "2022-cisco-vishing-mfa-fatigue",
          "2022-mailchimp-internal-tool-august",
          "2022-0ktapus-phishing-campaign",
          "2022-uber-mfa-fatigue",
          "2022-medibank-contractor-credentials-vpn",
          "2022-dropbox-github-phishing",
          "2023-mailchimp-employee-social-engineering",
          "2023-norton-lifelock-credential-stuffing",
          "2023-paypal-credential-stuffing",
          "2023-reddit-employee-phishing",
          "2023-chick-fil-a-credential-stuffing",
          "2023-retool-sms-phishing-authenticator-sync",
          "2023-23andme-credential-stuffing-dna-relatives",
          "2024-microsoft-midnight-blizzard-password-spray",
          "2024-change-healthcare-citrix-no-mfa",
          "2024-roku-credential-stuffing",
          "2024-snowflake-customer-tenant-campaign",
          "2024-ticketmaster-snowflake-account",
          "2024-advance-auto-parts-snowflake-account",
          "2024-neiman-marcus-snowflake-account",
          "2024-att-snowflake-call-records",
          "2025-aflac-social-engineering",
          "2025-allianz-life-crm-social-engineering",
          "2025-cisco-crm-vishing",
          "2025-workday-crm-social-engineering",
          "2025-mixpanel-smishing-openai-api-users",
          "2025-doordash-employee-social-engineering",
          "2025-upenn-development-systems-social-engineering",
          "2026-fortibleed-fortigate-credential-campaign",
          "2026-chick-fil-a-credential-stuffing",
          "2026-ringcentral-social-engineering",
          "2026-asos-employee-credential-theft",
          "2026-dexcom-targeted-vishing",
          "2026-microsoft-365-token-replay-79-orgs"
        ]
      },
      {
        "rank": 2,
        "key": "nhi-short-lived-credentials",
        "label": "An owned inventory of non-human identities, short-lived credentials, and no secrets in code or CI",
        "rule": "non_human = true, or initial access was exposed secrets or software supply chain",
        "count": 30,
        "pct": 26.1,
        "by_period": {
          "2021-2022": 6,
          "2023-2024": 10,
          "2025-2026": 14
        },
        "ids": [
          "2021-mimecast-certificate-compromise",
          "2021-malwarebytes-service-principal-abuse",
          "2021-verkada-super-admin-credentials",
          "2021-codecov-bash-uploader",
          "2022-ronin-bridge-validator-keys",
          "2022-github-heroku-travis-oauth-tokens",
          "2023-github-machine-account-token-code-signing",
          "2023-microsoft-ai-research-sas-token-exposure",
          "2023-okta-support-system-har-session-tokens",
          "2024-cloudflare-unrotated-okta-breach-credentials",
          "2024-sisense-gitlab-token-customer-credentials",
          "2024-dropbox-sign-service-account-compromise",
          "2024-new-york-times-exposed-github-token",
          "2024-internet-archive-exposed-gitlab-zendesk-tokens",
          "2024-cyberhaven-chrome-extension-oauth-consent-phishing",
          "2024-us-treasury-beyondtrust-api-key",
          "2025-tj-actions-changed-files-ci-secrets",
          "2025-commvault-metallic-azure-app-secrets",
          "2025-unc6040-salesforce-vishing-campaign",
          "2025-salesloft-drift-oauth-token-theft",
          "2025-nx-s1ngularity-npm-compromise",
          "2025-shai-hulud-npm-worm",
          "2025-gainsight-salesforce-token-abuse",
          "2025-shai-hulud-2-npm-worm",
          "2026-saas-provider-ai-coding-assistant-shai-hulud",
          "2026-teamfiltration-chile-service-accounts",
          "2026-jadepuffer-azure-service-principals",
          "2026-connectwise-cloud-backup-app-credential",
          "2026-zeabur-plaintext-admin-token",
          "2026-litellm-leaked-admin-key-poisoned-release"
        ]
      },
      {
        "rank": 3,
        "key": "third-party-access",
        "label": "Vendor, contractor and integration access through brokered, time-bound, logged paths",
        "rule": "Initial access was third-party access, or the record is a fan-out breach",
        "count": 24,
        "pct": 20.9,
        "by_period": {
          "2021-2022": 8,
          "2023-2024": 5,
          "2025-2026": 11
        },
        "ids": [
          "2021-mimecast-certificate-compromise",
          "2021-codecov-bash-uploader",
          "2021-nobelium-delegated-admin-privileges",
          "2022-okta-sitel-lapsus",
          "2022-github-heroku-travis-oauth-tokens",
          "2022-twilio-sms-phishing",
          "2022-signal-twilio-registration",
          "2022-doordash-vendor-phishing",
          "2023-circleci-engineer-session-token-theft",
          "2023-okta-support-system-har-session-tokens",
          "2024-sisense-gitlab-token-customer-credentials",
          "2024-cisco-duo-telephony-provider-phishing",
          "2024-us-treasury-beyondtrust-api-key",
          "2025-tj-actions-changed-files-ci-secrets",
          "2025-commvault-metallic-azure-app-secrets",
          "2025-salesloft-drift-oauth-token-theft",
          "2025-nx-s1ngularity-npm-compromise",
          "2025-shai-hulud-npm-worm",
          "2025-gainsight-salesforce-token-abuse",
          "2025-mixpanel-smishing-openai-api-users",
          "2025-shai-hulud-2-npm-worm",
          "2026-denmark-cpr-register-access-abuse",
          "2026-connectwise-cloud-backup-app-credential",
          "2026-litellm-leaked-admin-key-poisoned-release"
        ]
      },
      {
        "rank": 4,
        "key": "session-token-binding",
        "label": "Bound, short-lived sessions and tokens, revoked on reset",
        "rule": "Session or token theft, OAuth token abuse, a session-and-tokens failure, or a cookie, token replay or refresh token technique",
        "count": 18,
        "pct": 15.7,
        "by_period": {
          "2021-2022": 6,
          "2023-2024": 5,
          "2025-2026": 7
        },
        "ids": [
          "2021-malwarebytes-service-principal-abuse",
          "2021-electronic-arts-slack-cookie",
          "2022-github-heroku-travis-oauth-tokens",
          "2022-microsoft-aitm-phishing-bec",
          "2022-lastpass-vault-backup-theft",
          "2022-slack-github-stolen-tokens",
          "2023-circleci-engineer-session-token-theft",
          "2023-okta-support-system-har-session-tokens",
          "2023-boeing-citrix-bleed-lockbit",
          "2023-comcast-xfinity-citrix-bleed",
          "2024-mitre-nerve-ivanti-session-hijack",
          "2025-bybit-safe-wallet-aws-session-hijack",
          "2025-salesloft-drift-oauth-token-theft",
          "2025-gainsight-salesforce-token-abuse",
          "2026-pan-os-globalprotect-auth-bypass-ransomware",
          "2026-crowdsec-departing-engineer-github-token",
          "2026-saas-provider-ai-coding-assistant-shai-hulud",
          "2026-microsoft-365-token-replay-79-orgs"
        ]
      },
      {
        "rank": 5,
        "key": "infostealer-response",
        "label": "Treat an infostealer infection as an identity compromise: revoke sessions and rotate everything on the device",
        "rule": "Technique infostealer-credential-harvesting or session-cookie-theft",
        "count": 17,
        "pct": 14.8,
        "by_period": {
          "2021-2022": 5,
          "2023-2024": 10,
          "2025-2026": 2
        },
        "ids": [
          "2021-electronic-arts-slack-cookie",
          "2021-nobelium-password-spray-support-agent",
          "2022-microsoft-aitm-phishing-bec",
          "2022-lastpass-vault-backup-theft",
          "2022-uber-mfa-fatigue",
          "2023-circleci-engineer-session-token-theft",
          "2023-okta-support-system-har-session-tokens",
          "2023-boeing-citrix-bleed-lockbit",
          "2024-mitre-nerve-ivanti-session-hijack",
          "2024-snowflake-customer-tenant-campaign",
          "2024-ticketmaster-snowflake-account",
          "2024-advance-auto-parts-snowflake-account",
          "2024-neiman-marcus-snowflake-account",
          "2024-att-snowflake-call-records",
          "2024-disney-slack-employee-infostealer",
          "2025-nikkei-slack-infostealer",
          "2026-saas-provider-ai-coding-assistant-shai-hulud"
        ]
      },
      {
        "rank": 6,
        "key": "kill-dead-credentials",
        "label": "Kill credentials on departure, retirement and every upstream breach",
        "rule": "identity_failure = identity-lifecycle, or the abused credential should already have been dead",
        "count": 17,
        "pct": 14.8,
        "by_period": {
          "2021-2022": 3,
          "2023-2024": 8,
          "2025-2026": 6
        },
        "ids": [
          "2021-colonial-pipeline-legacy-vpn",
          "2022-ronin-bridge-validator-keys",
          "2022-cash-app-former-employee",
          "2023-okta-customer-help-desk-super-admin-takeover",
          "2023-clorox-help-desk-password-reset",
          "2023-mgm-resorts-help-desk-ransomware",
          "2023-caesars-it-vendor-social-engineering",
          "2024-microsoft-midnight-blizzard-password-spray",
          "2024-cloudflare-unrotated-okta-breach-credentials",
          "2024-snowflake-customer-tenant-campaign",
          "2024-internet-archive-exposed-gitlab-zendesk-tokens",
          "2025-powerschool-powersource-credential",
          "2025-marks-and-spencer-third-party-impersonation",
          "2025-gainsight-salesforce-token-abuse",
          "2026-crowdsec-departing-engineer-github-token",
          "2026-ghostaction-github-actions-secrets-wave",
          "2026-litellm-leaked-admin-key-poisoned-release"
        ]
      },
      {
        "rank": 7,
        "key": "identity-edge-tier-zero",
        "label": "Treat VPNs, SSO appliances and remote-support tools as tier zero identity systems",
        "rule": "initial_access = identity-infra-vulnerability",
        "count": 16,
        "pct": 13.9,
        "by_period": {
          "2021-2022": 3,
          "2023-2024": 5,
          "2025-2026": 8
        },
        "ids": [
          "2021-pulse-connect-secure-exploitation",
          "2021-coinbase-sms-recovery-flaw",
          "2022-crypto-com-2fa-bypass",
          "2023-storm-0558-microsoft-signing-key-forgery",
          "2023-boeing-citrix-bleed-lockbit",
          "2023-comcast-xfinity-citrix-bleed",
          "2024-mitre-nerve-ivanti-session-hijack",
          "2024-twilio-authy-unauthenticated-endpoint",
          "2025-fortiweb-cve-2025-64446-admin-creation",
          "2025-fortigate-forticloud-sso-saml-bypass",
          "2026-forticloud-sso-bypass-on-patched-fortigates",
          "2026-simplehelp-oidc-token-forgery",
          "2026-pan-os-globalprotect-auth-bypass-ransomware",
          "2026-n-able-n-central-auth-bypass",
          "2026-ivanti-connect-secure-uta0576",
          "2026-beyondtrust-remote-support-armory-castle"
        ]
      },
      {
        "rank": 8,
        "key": "mfa-on-every-path",
        "label": "MFA on every login path, including legacy VPNs, test tenants, service accounts and customer accounts",
        "rule": "mfa = absent",
        "count": 15,
        "pct": 13,
        "by_period": {
          "2021-2022": 2,
          "2023-2024": 12,
          "2025-2026": 1
        },
        "ids": [
          "2021-colonial-pipeline-legacy-vpn",
          "2022-medibank-contractor-credentials-vpn",
          "2023-norton-lifelock-credential-stuffing",
          "2023-paypal-credential-stuffing",
          "2023-chick-fil-a-credential-stuffing",
          "2023-23andme-credential-stuffing-dna-relatives",
          "2024-microsoft-midnight-blizzard-password-spray",
          "2024-change-healthcare-citrix-no-mfa",
          "2024-roku-credential-stuffing",
          "2024-snowflake-customer-tenant-campaign",
          "2024-ticketmaster-snowflake-account",
          "2024-advance-auto-parts-snowflake-account",
          "2024-neiman-marcus-snowflake-account",
          "2024-att-snowflake-call-records",
          "2026-teamfiltration-chile-service-accounts"
        ]
      },
      {
        "rank": 9,
        "key": "caller-verification",
        "label": "Verify callers before any help desk reset, and teach staff that IT never asks for codes or app approvals by phone",
        "rule": "Help desk social engineering (field or technique), or voice-led initial access",
        "count": 13,
        "pct": 11.3,
        "by_period": {
          "2021-2022": 3,
          "2023-2024": 5,
          "2025-2026": 5
        },
        "ids": [
          "2021-electronic-arts-slack-cookie",
          "2021-robinhood-support-vishing",
          "2022-cisco-vishing-mfa-fatigue",
          "2023-okta-customer-help-desk-super-admin-takeover",
          "2023-clorox-help-desk-password-reset",
          "2023-mgm-resorts-help-desk-ransomware",
          "2023-caesars-it-vendor-social-engineering",
          "2023-retool-sms-phishing-authenticator-sync",
          "2025-marks-and-spencer-third-party-impersonation",
          "2025-unc6040-salesforce-vishing-campaign",
          "2025-cisco-crm-vishing",
          "2026-ringcentral-social-engineering",
          "2026-dexcom-targeted-vishing"
        ]
      },
      {
        "rank": 10,
        "key": "oauth-app-governance",
        "label": "Govern OAuth apps and consent: allow-list connected apps, restrict user consent, revoke idle tokens",
        "rule": "OAuth token abuse or consent phishing (field or technique), or refresh token abuse",
        "count": 8,
        "pct": 7,
        "by_period": {
          "2021-2022": 2,
          "2023-2024": 2,
          "2025-2026": 4
        },
        "ids": [
          "2021-malwarebytes-service-principal-abuse",
          "2022-github-heroku-travis-oauth-tokens",
          "2024-microsoft-midnight-blizzard-password-spray",
          "2024-cyberhaven-chrome-extension-oauth-consent-phishing",
          "2025-unc6040-salesforce-vishing-campaign",
          "2025-salesloft-drift-oauth-token-theft",
          "2025-gainsight-salesforce-token-abuse",
          "2026-crowdsec-departing-engineer-github-token"
        ]
      }
    ],
    "covered_by_any": 108,
    "uncovered": [
      {
        "id": "2021-ubiquiti-insider-cloud-credentials",
        "access": "insider-misuse"
      },
      {
        "id": "2022-microsoft-lapsus-account",
        "access": "stolen-credentials"
      },
      {
        "id": "2022-t-mobile-lapsus-stolen-credentials",
        "access": "stolen-credentials"
      },
      {
        "id": "2022-optus-unauthenticated-api",
        "access": "misconfiguration"
      },
      {
        "id": "2023-sumo-logic-aws-credential-compromise",
        "access": "stolen-credentials"
      },
      {
        "id": "2024-teamviewer-apt29-employee-account",
        "access": "stolen-credentials"
      },
      {
        "id": "2025-coinbase-paid-support-insiders",
        "access": "insider-misuse"
      }
    ],
    "median_controls_per_incident": 2,
    "incidents_with_3plus_controls": 21,
    "top_three_union": 77
  }
}