{ "name": "Identity Breach Database", "publisher": "Start with Identity", "url": "https://startwithidentity.com/breaches/incidents/", "license": "CC BY 4.0", "schema": "https://startwithidentity.com/breaches/incidents/", "count": 115, "incidents": [ { "techniques": [ "aitm-phishing-proxy", "device-code-phishing", "token-replay-unbound-endpoint" ], "cves": [], "vendors": [ "iam/microsoft-entra" ], "teardown": null, "records_affected": null, "records_note": "497 successful sign-ins and more than 200,000 failed login attempts across 79 victim organizations, per Huntress.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [ "/blog/2026-10-22-huntress-tracks-stolen-session-replay-into-79-microsoft-365-organizations/" ], "verified_on": "2026-10-31", "id": "2026-microsoft-365-token-replay-79-orgs", "name": "Stolen Microsoft 365 session tokens replayed into 79 organizations", "victim": "Multiple: 79 organizations monitored by Huntress", "industry": "cross-industry", "country": "Global", "incident_date": "2026-07-14", "disclosed": "2026-10-22", "actor": null, "actor_type": "unknown", "initial_access": "phishing-aitm", "identity_failure": "session-and-tokens", "mfa": "bypassed", "non_human": false, "summary": "Huntress reported on October 22, 2026 that one actor replayed Microsoft 365 tokens stolen through adversary-in-the-middle phishing and device-code phishing into 79 organizations between July 14 and September 22, 2026. The actor registered at least 48 rogue Entra devices and wiped and replaced victims' MFA methods, in 19 organizations within three hours of the first sign-in, so that access survived password resets.", "identity_lesson": "The tokens worked from the attacker's infrastructure and the account let the attacker re-enrol MFA. Token protection and device binding, blocking device-code flow where unneeded, and requiring step-up to change MFA methods are the controls.", "sources": [ { "title": "M365 Token Spray and Replay Campaign Compromises Business Email Accounts", "publisher": "Huntress", "url": "https://www.huntress.com/blog/token-replay-spray", "date": "2026-10-22" } ] }, { "techniques": [ "secrets-in-repositories-and-ci" ], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "LiteLLM did not publish download or affected-user counts; the malicious packages were live for about two hours.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [ "/blog/2026-10-21-poisoned-litellm-1-107-0-shipped-a-credential-stealer-to-pypi-and-docker/", "/blog/2026-10-23-litellm-traces-poisoned-release-to-an-admin-key-leaked-in-may-and-never-revoked/" ], "verified_on": "2026-10-31", "id": "2026-litellm-leaked-admin-key-poisoned-release", "name": "LiteLLM poisoned PyPI and Docker release traced to a leaked, never-revoked admin key", "victim": "LiteLLM (BerriAI) and users who installed litellm 1.107.0", "industry": "technology", "country": "United States", "incident_date": "2026-10-10", "disclosed": "2026-10-21", "actor": null, "actor_type": "unknown", "initial_access": "exposed-secrets", "identity_failure": "non-human-identity", "mfa": "not-applicable", "non_human": true, "summary": "LiteLLM said on October 21, 2026 that a malicious litellm 1.107.0 with a credential stealer and backdoor was published to PyPI, Docker Hub and GHCR. Its October 23 root cause report says an Agent Platform admin key committed to a public repository on May 27 was deleted but never revoked; on October 10 the attacker used it to retrieve a GitHub organization owner's CLI OAuth token, used workflows to steal two maintainers' tokens, and then pushed and approved the release.", "identity_lesson": "Deleting a leaked key from a repo is not revocation. Revoking on exposure, refusing to store other users' OAuth tokens in an agent platform, and requiring a human with phishing-resistant MFA for release approval would each have broken the chain.", "sources": [ { "title": "Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised", "publisher": "LiteLLM", "url": "https://docs.litellm.ai/blog/security-incident-oct-21-2026", "date": "2026-10-21" }, { "title": "The attack chain behind the v1.107.0 LiteLLM release", "publisher": "LiteLLM", "url": "https://docs.litellm.ai/blog/security-incident-oct-21-2026-attack-chain", "date": "2026-10-23" } ] }, { "techniques": [ "secrets-in-repositories-and-ci", "static-api-key-abuse" ], "cves": [], "vendors": [], "teardown": null, "records_affected": 321810, "records_note": "Accounts (email, username, phone and profile data), plus 3,218,965 service environment-variable records, per Zeabur's preliminary report.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [ "/blog/2026-10-19-zeabur-to-shut-down-after-a-non-expiring-admin-token-opened-its-shared-cluster/" ], "verified_on": "2026-10-31", "id": "2026-zeabur-plaintext-admin-token", "name": "Zeabur shared cluster breached with a non-expiring admin token and plaintext AWS keys", "victim": "Zeabur", "industry": "b2b-saas", "country": "United States", "incident_date": "2026-10-14", "disclosed": "2026-10-19", "actor": null, "actor_type": "unknown", "initial_access": "exposed-secrets", "identity_failure": "non-human-identity", "mfa": "not-applicable", "non_human": true, "summary": "Zeabur's October 19, 2026 preliminary report says an intrusion began on October 14 with an internal AWS key and a shared-cluster admin token created in January 2024 with no expiry, both stored in plaintext in a private configuration repository; how the attacker obtained them is not confirmed. The attack triggered no alerts for more than 16 hours and exposed 321,810 accounts and about 3.2 million environment-variable records. Zeabur, a developer hosting platform, has announced it will shut down on December 31, 2026 and describes that as an operational decision.", "identity_lesson": "A never-expiring cluster admin token and static cloud keys sat in a repository. Short-lived, scoped machine credentials issued at runtime, and keeping admin interfaces off the public internet, remove the single point of failure.", "sources": [ { "title": "Zeabur October 2026 security incident (preliminary report)", "publisher": "Zeabur", "url": "https://zeabur.com/blogs/october-2026-security-incident", "date": "2026-10-19" } ] }, { "techniques": [], "cves": [], "vendors": [ "iam/microsoft-entra" ], "teardown": null, "records_affected": null, "records_note": "Huntress confirmed unauthorized sign-ins in 162 tenants by October 16; Microsoft said Storm-0940 attempted sign-ins to more than 2,250 tenants after the ConnectWise compromise.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [ "/blog/2026-10-16-one-connectwise-app-credential-opened-microsoft-365-tenants-across-msp-customers/", "/blog/2026-10-21-storm-0940-used-connectwise-app-identities-to-reach-2250-microsoft-365-tenants/" ], "verified_on": "2026-10-31", "id": "2026-connectwise-cloud-backup-app-credential", "name": "Stolen ConnectWise app credentials open Microsoft 365 tenants across MSP customers", "victim": "ConnectWise and Microsoft 365 tenants of its customers", "industry": "b2b-saas", "country": "United States", "incident_date": "2026-10-15", "disclosed": "2026-10-16", "actor": "Storm-0940, China-state aligned (per Microsoft); Huntress has not tied all activity to one operator", "actor_type": "nation-state", "initial_access": "third-party-access", "identity_failure": "non-human-identity", "mfa": "not-applicable", "non_human": true, "summary": "Huntress found on October 15 and 16, 2026 that an attacker was signing in as the ConnectWise Cloud Backup (formerly SkyKick) Entra application with a credential that lived in the vendor's own tenant, obtaining Microsoft Graph tokens in customer tenants; in one tenant a second ConnectWise app granted itself Global Administrator and added secrets to other applications. ConnectWise disabled the app identities, and Microsoft said on October 21 that Storm-0940 used stolen ConnectWise application identities and the ARTEX agentic AI framework, in some cases reaching privileged cloud access in under three hours.", "identity_lesson": "A vendor's multi-tenant app credential was a skeleton key to every tenant that had consented to it. Reviewing third-party service principals' permissions, restricting them with conditional access for workload identities, and alerting on directory role changes by apps are the controls.", "sources": [ { "title": "ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks", "publisher": "Huntress", "url": "https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access", "date": "2026-10-16" }, { "title": "AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise", "publisher": "Microsoft Security Blog", "url": "https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/", "date": "2026-10-21" } ] }, { "techniques": [], "cves": [ "cve-2026-102764" ], "vendors": [ "pam/beyondtrust" ], "teardown": null, "records_affected": null, "records_note": "No victims named; exploitation was first seen on a single self-hosted appliance on August 29, 2026.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [ "/blog/2026-10-15-beyondtrust-remote-support-zero-day-let-armory-castle-dump-the-credential-vault/" ], "verified_on": "2026-10-31", "id": "2026-beyondtrust-remote-support-armory-castle", "name": "BeyondTrust Remote Support zero-day used to dump the appliance credential vault", "victim": "Multiple: self-hosted BeyondTrust Remote Support appliances", "industry": "technology", "country": "Global", "incident_date": "2026-08-29", "disclosed": "2026-10-15", "actor": "Armory Castle (previously tracked as UNC5221), China-nexus, per Google Threat Intelligence and Mandiant reporting", "actor_type": "nation-state", "initial_access": "identity-infra-vulnerability", "identity_failure": "credential-storage", "mfa": "not-applicable", "non_human": false, "summary": "CVE-2026-102764, an improper origin validation flaw in self-hosted BeyondTrust Remote Support, was exploited as a zero-day from August 29, 2026 by the China-nexus group Armory Castle. Google Threat Intelligence and Mandiant reported the attacker tried to harvest credentials from the appliance's secrets database, targeted configuration templates for passwordless root on the site service account, and used compromised administrator credentials to open remote sessions to downstream systems and exfiltrate documents. CISA added it to its Known Exploited Vulnerabilities catalog on October 16.", "identity_lesson": "A privileged remote access appliance concentrates the credentials for everything it reaches. Rotating every vaulted credential after exposure, and requiring per-session approval for Jump Item access, contain the blast radius.", "sources": [ { "title": "China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers", "publisher": "The Hacker News", "url": "https://thehackernews.com/2026/10/china-linked-hackers-exploited.html", "date": "2026-10-16" } ] }, { "techniques": [ "kerberoasting" ], "cves": [ "cve-2026-104935", "cve-2026-111357" ], "vendors": [], "teardown": null, "records_affected": null, "records_note": "No victims named and no compromise count published.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [ "/blog/2026-10-14-ivanti-connect-secure-auth-bypass-exploited-cisa-gives-three-days/" ], "verified_on": "2026-10-31", "id": "2026-ivanti-connect-secure-uta0576", "name": "Ivanti Connect Secure header-spoofing auth bypass exploited to harvest AD credentials", "victim": "Multiple: Ivanti Connect Secure VPN operators", "industry": "cross-industry", "country": "Global", "incident_date": "2026-10-01", "disclosed": "2026-10-13", "actor": "UTA0576 (Volexity)", "actor_type": "financially-motivated", "initial_access": "identity-infra-vulnerability", "identity_failure": "authentication", "mfa": "not-applicable", "non_human": false, "summary": "CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and, chained with a privilege escalation, run commands as root. Volexity observed UTA0576 exploiting it from October 3, 2026 (decoys saw attempts from October 1), extracting credentials stored on the appliance, capturing LDAP traffic, running a Kerberoasting tool and searching for administrator passwords and BitLocker recovery keys. CISA added it to its Known Exploited Vulnerabilities catalog with an October 16 deadline.", "identity_lesson": "The VPN appliance was both the front door and a store of directory credentials. Rotating every credential the appliance held or saw after exposure, and using gMSA or long random service account passwords against Kerberoasting, limit the follow-on damage.", "sources": [ { "title": "CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts", "publisher": "The Hacker News", "url": "https://thehackernews.com/2026/10/cisa-urges-immediate-ivanti-connect.html", "date": "2026-10-14" } ] }, { "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "Dexcom has not said what information the documents contained or how many people are affected.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [ "/blog/2026-10-10-dexcom-says-targeted-vishing-led-to-access-to-internal-documents/" ], "verified_on": "2026-10-31", "id": "2026-dexcom-targeted-vishing", "name": "Dexcom internal documents accessed after targeted vishing", "victim": "Dexcom", "industry": "healthcare", "country": "United States", "incident_date": null, "disclosed": "2026-10-10", "actor": null, "actor_type": "unknown", "initial_access": "phishing-credentials", "identity_failure": "authentication", "mfa": "unknown", "non_human": false, "summary": "Dexcom said on October 10, 2026 that targeted vishing events led to unauthorized access to limited information in certain internal documents. It said the incident was contained, with no impact on its products or operations, and that it engaged an outside forensics firm; class actions filed afterward cite a ShinyHunters claim that Dexcom has not confirmed.", "identity_lesson": "Phone-based social engineering reached internal documents. Call-back verification before any credential or MFA change, and phishing-resistant MFA, make a convincing caller far less useful.", "sources": [ { "title": "Dexcom Cybersecurity update", "publisher": "Dexcom", "url": "https://www.dexcom.com/en-us/cyberupdate", "date": "2026-10-10" }, { "title": "Dexcom class action lawsuits claim ShinyHunters stole health data", "publisher": "Top Class Actions", "url": "https://topclassactions.com/lawsuit-settlements/lawsuit-news/dexcom-class-action-lawsuits-claim-shinyhunters-stole-health-data/", "date": "2026-10-28" } ] }, { "techniques": [ "secrets-in-repositories-and-ci" ], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "In October the attacker attempted to extract 3,174 secrets from public repositories' CI, per GitGuardian; from August to September, 26 secrets were exfiltrated from 13 repositories.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [ "/blog/2026-10-15-ghostaction-returns-with-1900-hijacked-github-accounts-and-30000-repos/" ], "verified_on": "2026-10-31", "id": "2026-ghostaction-github-actions-secrets-wave", "name": "GhostAction returns: hijacked GitHub accounts push secret-stealing workflows", "victim": "Multiple: about 1,900 GitHub accounts and more than 30,000 repositories", "industry": "technology", "country": "Global", "incident_date": "2026-08-31", "disclosed": "2026-10-07", "actor": "GhostAction operators (unattributed)", "actor_type": "unknown", "initial_access": "stolen-credentials", "identity_failure": "credential-storage", "mfa": "unknown", "non_human": false, "summary": "GitGuardian reported on October 7, 2026 a new GhostAction wave that began August 31 and spiked on October 8 and 9, when commits from about 1,900 compromised GitHub accounts added workflows to more than 30,000 repositories that dump Actions secrets and scan git history for credentials. GitGuardian did not determine how the accounts were compromised; some victims had been hit in the 2025 GhostAction campaign and never rotated their secrets. GitHub blocked the workflow from running starting October 9.", "identity_lesson": "Compromised developer accounts were used to reach CI secrets, and secrets left unrotated after the 2025 wave were still usable. Rotation after any exposure, environment-protected secrets and OIDC-based short-lived cloud credentials in CI shrink what a push can steal.", "sources": [ { "title": "GhostAction Returns: 772 Repos Hit, 30k More in Oct", "publisher": "GitGuardian", "url": "https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/", "date": "2026-10-07" }, { "title": "GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories", "publisher": "The Hacker News", "url": "https://thehackernews.com/2026/10/ghostaction-compromises-about-1900.html", "date": "2026-10-15" } ] }, { "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "ASOS has not said how many customers are affected; it said payment card data and account passwords were not compromised.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [ "/blog/2026-10-08-asos-breach-began-with-an-employee-tricked-out-of-their-login/" ], "verified_on": "2026-10-31", "id": "2026-asos-employee-credential-theft", "name": "ASOS customer data reached with an employee login obtained by impersonation", "victim": "ASOS", "industry": "retail-ecommerce", "country": "United Kingdom", "incident_date": null, "disclosed": "2026-10-06", "actor": "Xuanye (claimed)", "actor_type": "unknown", "initial_access": "phishing-credentials", "identity_failure": "authentication", "mfa": "unknown", "non_human": false, "summary": "On October 6, 2026 ASOS app users received rogue push notifications from a group calling itself Xuanye that referred to Snowflake. ASOS said on October 8 that an unauthorized party impersonated a trusted contact to obtain an employee's login credentials and used them to access customer names, contact details and some non-personal account information on certain third-party platforms. Snowflake said the incident did not result from any flaw in its service.", "identity_lesson": "An impersonated contact obtained a working login to customer data platforms. Phishing-resistant MFA on any account that can query customer data, and out-of-band verification of credential requests, are the controls.", "sources": [ { "title": "Asos confirms breach of customer data after hackers send rogue app notification", "publisher": "TechCrunch", "url": "https://techcrunch.com/2026/10/08/asos-confirms-breach-of-customer-data-after-hackers-send-rogue-app-notification/", "date": "2026-10-08" }, { "title": "ASOS links data breach to social engineering attack, credential theft", "publisher": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/asos-links-data-breach-to-social-engineering-attack-credential-theft/", "date": "2026-10-08" } ] }, { "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": 8800000, "records_note": "People whose names, addresses and CPR numbers were accessed, per the CPR administration. A person claiming responsibility said the account password was 123456; authorities have not confirmed that.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [ "/blog/2026-10-13-123456-password-linked-to-denmark-cpr-breach-of-8-8-million-people/" ], "verified_on": "2026-10-31", "id": "2026-denmark-cpr-register-access-abuse", "name": "Danish CPR register queried through a private company's abused access", "victim": "Danish Civil Registration System (CPR), via the access of Pays ApS", "industry": "government", "country": "Denmark", "incident_date": "2026-09-10", "disclosed": "2026-10-05", "actor": null, "actor_type": "unknown", "initial_access": "third-party-access", "identity_failure": "authentication", "mfa": "unknown", "non_human": false, "summary": "Denmark's CPR administration disclosed on October 5, 2026 that a Danish company's lawful access to the national CPR register had been abused to retrieve data on about 8.8 million people. The company, Pays ApS, confirmed its access had been exploited; the attacker ran about 14 million automated searches between September 10 and 20, and the intrusion was detected on October 2.", "identity_lesson": "A third party's credentials to a national register allowed millions of lookups without challenge. Phishing-resistant MFA for every organization with register access, and rate limits that flag bulk queries, are the controls.", "sources": [ { "title": "'123456' password linked to Denmark data breach affecting 8.8M people", "publisher": "The Register", "url": "https://www.theregister.com/security/2026/10/13/123456-password-linked-to-denmark-data-breach-affecting-88m-people/5302726", "date": "2026-10-13" } ] }, { "techniques": [ "secrets-in-repositories-and-ci", "static-api-key-abuse" ], "cves": [], "vendors": [ "iam/microsoft-entra" ], "teardown": null, "records_affected": null, "records_note": "More than 100 storage accounts targeted in one tenant; no data-subject count.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [ "/blog/2026-09-28-jadepuffer-used-leaked-service-principal-credentials-to-wipe-azure-tenants/" ], "verified_on": "2026-10-31", "id": "2026-jadepuffer-azure-service-principals", "name": "JadePuffer wipes Azure resources with compromised service principals", "victim": "Unnamed Azure customer tenant (Microsoft case)", "industry": "cross-industry", "country": "Not disclosed", "incident_date": "2026-06", "disclosed": "2026-09-25", "actor": "Storm-3168 (JadePuffer), per Microsoft", "actor_type": "extortion-group", "initial_access": "exposed-secrets", "identity_failure": "non-human-identity", "mfa": "not-applicable", "non_human": true, "summary": "Microsoft reported on September 25, 2026 two June attacks in which the ransomware operator it tracks as Storm-3168 (JadePuffer) used two compromised service principals in one tenant, driven by an AI agent toolchain, to map the environment, request storage account keys and delete most targeted storage accounts within seven minutes. Microsoft could not determine the initial access, but credentials for one of the service principals had appeared in a public GitHub issue before the attacks.", "identity_lesson": "A workload secret posted in public carried standing rights to read keys and destroy resources. Managed identities or workload identity federation remove the secret, and separating destructive permissions from read access limits what one leak can do.", "sources": [ { "title": "Storm-3168: Agentic-driven cloud attacks using compromised service principals", "publisher": "Microsoft Security Blog", "url": "https://www.microsoft.com/en-us/security/blog/2026/09/25/storm-3168-agentic-driven-cloud-attacks-using-compromised-service-principals/", "date": "2026-09-25" }, { "title": "JadePuffer agentic AI attacks target Azure, destroy cloud resources", "publisher": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/jadepuffer-agentic-ai-attacks-target-azure-destroy-cloud-resources/", "date": "2026-09-28" } ] }, { "techniques": [ "password-spraying" ], "cves": [], "vendors": [ "iam/microsoft-entra" ], "teardown": null, "records_affected": null, "records_note": "More than 5,700 accounts targeted; 7 compromised, all unmanaged functional or service accounts, per Proofpoint.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [ "/blog/2026-09-24-teamfiltration-spraying-found-seven-service-accounts-on-default-passwords/" ], "verified_on": "2026-10-31", "id": "2026-teamfiltration-chile-service-accounts", "name": "Password spraying across Chilean Microsoft 365 tenants lands on default-password service accounts", "victim": "Multiple: 28 Microsoft 365 tenants of Chilean retailers and financial institutions", "industry": "cross-industry", "country": "Chile", "incident_date": "2026-07-21", "disclosed": "2026-09-24", "actor": "UNK_CondorFiltration (Proofpoint)", "actor_type": "unknown", "initial_access": "password-spraying", "identity_failure": "non-human-identity", "mfa": "absent", "non_human": true, "summary": "Proofpoint tracked a TeamFiltration password-spraying campaign from July to August 2026 against 28 Microsoft 365 tenants in Chile, aimed at major banks and a large retailer. It sprayed more than 5,700 accounts from 1,487 AWS IP addresses and compromised seven, all functional or service accounts with no MFA on default or never-rotated passwords; six fell within seven minutes.", "identity_lesson": "The humans held; the unowned service accounts did not. Inventorying functional accounts, removing interactive sign-in or enforcing MFA on them, and rotating provisioned default passwords would have left the spray with nothing.", "sources": [ { "title": "TeamFiltration Campaign Compromises Seven Microsoft 365 Accounts Using Default Passwords", "publisher": "The Hacker News", "url": "https://thehackernews.com/2026/09/teamfiltration-compromises-seven.html", "date": "2026-09-24" } ] }, { "techniques": [ "orphaned-account-abuse" ], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "About 170 private repositories copied; the leak included email addresses of 83 CrowdSec users and details of 51 potential investors, per CrowdSec's September 18 report.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [ "/blog/2026-09-19-crowdsec-kept-a-departing-engineers-github-access-open-and-lost-170-repos/" ], "verified_on": "2026-10-31", "id": "2026-crowdsec-departing-engineer-github-token", "name": "CrowdSec private repositories copied with a departing engineer's GitHub token", "victim": "CrowdSec", "industry": "technology", "country": "France", "incident_date": "2026-05-22", "disclosed": "2026-09-17", "actor": null, "actor_type": "unknown", "initial_access": "oauth-token-abuse", "identity_failure": "identity-lifecycle", "mfa": "not-applicable", "non_human": false, "summary": "CrowdSec said on September 17, 2026 that source code had been exposed, first linking it to the May 11 TanStack npm attack. Its September 18 report instead traced the copy to a former employee's GitHub account, left open so he could finish some work, whose still-valid OAuth token was used on May 22 to copy about 170 private repositories. The account was removed from the organization on May 25 and the code appeared on a forum in September; the two statements disagree on whether user and investor data leaked.", "identity_lesson": "Access kept open for a leaver, through a token that bypasses MFA, did the damage. Offboarding should revoke OAuth tokens and organization membership on the last day, with exceptions time-boxed and monitored.", "sources": [ { "title": "CrowdSec Statement: Source Code Exposure in May 2026", "publisher": "CrowdSec", "url": "https://www.crowdsec.net/blog/crowdsec-statement-source-code-exposure", "date": "2026-09-17" }, { "title": "TanStack Supply Chain Attack Analysis", "publisher": "CrowdSec", "url": "https://www.crowdsec.net/blog/tanstack-supply-chain-attack-analysis", "date": "2026-09-18" }, { "title": "CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories", "publisher": "The Hacker News", "url": "https://thehackernews.com/2026/09/crowdsec-says-tanstack-npm-attack-led.html", "date": "2026-09-19" } ] }, { "techniques": [ "infostealer-credential-harvesting" ], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "About 100 internal code repositories infected; repository secrets and product source code stolen, per Mandiant.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [ "/blog/2026-09-16-hijacked-ai-coding-assistant-session-spread-shai-hulud-to-100-repos/" ], "verified_on": "2026-10-31", "id": "2026-saas-provider-ai-coding-assistant-shai-hulud", "name": "Hijacked AI coding assistant session spreads Shai-Hulud inside a SaaS provider", "victim": "Unnamed SaaS provider (Mandiant case study)", "industry": "b2b-saas", "country": "Not disclosed", "incident_date": null, "disclosed": "2026-09-16", "actor": null, "actor_type": "unknown", "initial_access": "supply-chain", "identity_failure": "session-and-tokens", "mfa": "not-applicable", "non_human": true, "summary": "Mandiant described an intrusion at an unnamed SaaS provider in which a developer accepted poisoned software recommended through an AI coding assistant session the attacker had hijacked. The attacker installed an infostealer through a poisoned PyPI package, stole GitHub OAuth tokens, deployed the Shai-Hulud worm across about 100 internal repositories, and poisoned a package in the company's own namespace, which infected a second employee.", "identity_lesson": "Developer OAuth tokens on a workstation gave the worm write access to the company's code. Short-lived, device-bound developer tokens and review of AI-suggested dependencies before install limit the spread.", "sources": [ { "title": "Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories", "publisher": "The Hacker News", "url": "https://thehackernews.com/2026/09/attacker-hijacks-ai-coding-assistant.html", "date": "2026-09-16" } ] }, { "techniques": [], "cves": [ "cve-2026-18577" ], "vendors": [], "teardown": null, "records_affected": null, "records_note": null, "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [ "/blog/2026-08-03-n-able-n-central-auth-bypass-first-fix-incomplete/", "/blog/2026-08-07-n-able-n-central-god-mode-flaw-reached-customer-networks/" ], "verified_on": "2026-10-31", "id": "2026-n-able-n-central-auth-bypass", "name": "N-able N-central authentication bypass used to reach managed customer networks", "victim": "Multiple: N-able N-central on-premises customers (a limited number, per N-able)", "industry": "technology", "country": "Global", "incident_date": "2026-07-31", "disclosed": "2026-08-03", "actor": null, "actor_type": "unknown", "initial_access": "identity-infra-vulnerability", "identity_failure": "authentication", "mfa": "not-applicable", "non_human": false, "summary": "N-able said attackers exploited CVE-2026-18577, an N-central flaw that gives an unauthenticated attacker administrative access, after its Adlumin service flagged suspicious activity at a customer on July 31, 2026. Attackers used N-central's Take Control feature to connect to systems in managed environments and registered Cloudflare Tunnel services to keep access; N-able said the first hotfix was incomplete and shipped a second on August 7.", "identity_lesson": "An RMM console that skipped authentication handed out admin access to every managed endpoint. RMM management planes need to be off the internet and behind phishing-resistant MFA, with alerts on new remote sessions.", "sources": [ { "title": "N-able Says Attackers Take Over N-central Servers After Initial Fix Proves Incomplete", "publisher": "The Hacker News", "url": "https://thehackernews.com/2026/08/n-able-says-attackers-take-over-n.html", "date": "2026-08-03" }, { "title": "N-able God mode flaw: Vendor confirms attackers reached customer networks as second hotfix lands", "publisher": "The Register", "url": "https://www.theregister.com/networks/2026/08/07/n-able-god-mode-flaw-vendor-confirms-attackers-reached-customer-networks-as-second-hotfix-lands/5284730", "date": "2026-08-07" } ] }, { "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "Have I Been Pwned counted about 1.6 million unique email addresses in the leaked data; RingCentral has not published a count.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [ "/blog/2026-08-14-ringcentral-1-6-million-records-leaked-after-one-vishing-call/" ], "verified_on": "2026-10-31", "id": "2026-ringcentral-social-engineering", "name": "RingCentral customer data stolen after a social engineering attack", "victim": "RingCentral", "industry": "b2b-saas", "country": "United States", "incident_date": null, "disclosed": "2026-07-28", "actor": "ShinyHunters (claimed)", "actor_type": "extortion-group", "initial_access": "phishing-credentials", "identity_failure": "authentication", "mfa": "unknown", "non_human": false, "summary": "RingCentral disclosed on July 28, 2026 that it was the target of a sophisticated social engineering campaign affecting a limited portion of its customers. ShinyHunters claimed the theft, told reporters it had voice-phished an employee into giving up a password, and leaked the data after RingCentral refused to pay; the vishing detail is the group's claim, not RingCentral's.", "identity_lesson": "A password given up over the phone was enough to reach customer records. Phishing-resistant MFA removes the value of anything an employee can read out to a caller.", "sources": [ { "title": "1.6M RingCentral accounts' data dumped after ShinyHunters extortion attack", "publisher": "The Register", "url": "https://www.theregister.com/cyber-crime/2026/08/14/16m-ringcentral-accounts-data-dumped-after-shinyhunters-extortion-attack/5288003", "date": "2026-08-14" }, { "title": "RingCentral data breach exposed info of 1.6 million accounts", "publisher": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/ringcentral-data-breach-exposed-info-of-16-million-accounts/", "date": "2026-08-14" } ] }, { "techniques": [ "credential-stuffing" ], "cves": [], "vendors": [], "teardown": null, "records_affected": 13322, "records_note": "Customers, per Chick-fil-A's filing with the Maine Attorney General.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [ "/blog/2026-07-24-chick-fil-a-credential-stuffing-breach-hits-13000-loyalty-accounts/" ], "verified_on": "2026-10-31", "id": "2026-chick-fil-a-credential-stuffing", "name": "Chick-fil-A One loyalty accounts taken over by credential stuffing", "victim": "Chick-fil-A", "industry": "retail-ecommerce", "country": "United States", "incident_date": "2026-06-17", "disclosed": "2026-07-24", "actor": null, "actor_type": "financially-motivated", "initial_access": "credential-stuffing", "identity_failure": "authentication", "mfa": "unknown", "non_human": false, "summary": "Chick-fil-A said automated attacks between June 17 and June 19, 2026 used credentials obtained from a third-party source to log in to Chick-fil-A One loyalty accounts on its website and app. Exposed data included names, emails, membership numbers, stored credit balances, mobile pay numbers and the last four digits of payment cards. It is the company's second credential stuffing incident after one disclosed in March 2023.", "identity_lesson": "Accounts holding stored value accepted reused passwords from other breaches. Bot detection, breached-password checks and passkeys or MFA on accounts with payment methods are the controls.", "sources": [ { "title": "Chick-fil-A data breach affects more than 13,000 customers", "publisher": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/chick-fil-a-data-breach-affects-more-than-13-000-customers/", "date": "2026-07-24" } ] }, { "techniques": [], "cves": [], "vendors": [ "zero-trust/palo-alto" ], "teardown": null, "records_affected": null, "records_note": "No victim count published; Unit 42 lists affected sectors from education to utilities.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [ "/blog/2026-07-21-qilin-ransomware-exploits-pan-os-auth-bypass-for-initial-access/", "/blog/2026-10-19-qilin-and-inc-use-globalprotect-auth-bypass-to-skip-mfa-and-dump-dc-disks/" ], "verified_on": "2026-10-31", "id": "2026-pan-os-globalprotect-auth-bypass-ransomware", "name": "GlobalProtect authentication bypass used as a ransomware front door", "victim": "Multiple: organizations running unpatched PAN-OS GlobalProtect", "industry": "cross-industry", "country": "Global", "incident_date": "2026-06", "disclosed": "2026-07-21", "actor": "Qilin (Spikey Scorpius) and INC (Tarnished Scorpius) ransomware affiliates, per Arctic Wolf and Unit 42", "actor_type": "extortion-group", "initial_access": "identity-infra-vulnerability", "identity_failure": "session-and-tokens", "mfa": "bypassed", "non_human": false, "summary": "Arctic Wolf traced multiple June 2026 Qilin intrusions to a patched PAN-OS GlobalProtect authentication bypass that lets attackers open a VPN session without valid credentials where authentication override cookies are misconfigured. Unit 42 tracks the flaw as CVE-2026-0257 and reported in October 2026 that Qilin and INC operators used it, in one case pivoting to vCenter and dumping credentials offline from a domain controller's virtual disk.", "identity_lesson": "A forgeable session cookie stood in for the user's login and MFA. A dedicated certificate for authentication override cookies, or disabling the override, plus prompt patching of VPN gateways, are the controls Palo Alto Networks recommends.", "sources": [ { "title": "Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Access", "publisher": "The Hacker News", "url": "https://thehackernews.com/2026/07/qilin-ransomware-attackers-exploit-pan.html", "date": "2026-07-21" }, { "title": "Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20)", "publisher": "Unit 42, Palo Alto Networks", "url": "https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/", "date": "2026-10-20" } ] }, { "techniques": [], "cves": [ "cve-2026-48558" ], "vendors": [], "teardown": null, "records_affected": null, "records_note": "Arctic Wolf estimated about 14,000 internet-exposed SimpleHelp servers, roughly 1,000 of them directly vulnerable. No victim count.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [ "/blog/2026-06-12-simplehelp-rmm-oidc-token-forgery-bypasses-mfa-for-ransomware-access/" ], "verified_on": "2026-10-31", "id": "2026-simplehelp-oidc-token-forgery", "name": "SimpleHelp RMM OIDC token forgery exploited for technician access", "victim": "Multiple: SimpleHelp RMM servers using OIDC group login", "industry": "technology", "country": "Global", "incident_date": null, "disclosed": "2026-06-30", "actor": null, "actor_type": "unknown", "initial_access": "identity-infra-vulnerability", "identity_failure": "authentication", "mfa": "bypassed", "non_human": false, "summary": "CVE-2026-48558, disclosed on June 12, 2026, lets an unauthenticated attacker forge OpenID Connect tokens against SimpleHelp servers configured for OIDC group login because token signatures are not properly validated, granting technician-level access without credentials or MFA. Arctic Wolf reported active exploitation, with attackers deploying custom malware to harvest credentials and persist across managed environments; CISA set a July 2, 2026 remediation deadline.", "identity_lesson": "The server trusted identity tokens it never verified. Strict signature and issuer validation in any OIDC relying party, and keeping RMM consoles off the open internet, are the fixes.", "sources": [ { "title": "CVE-2026-48558: Critical authentication bypass vulnerability in SimpleHelp RMM exploited for credential theft and malware delivery", "publisher": "Arctic Wolf", "url": "https://arcticwolf.com/resources/blog/cve-2026-48558-critical-authentication-bypass-vulnerability-in-simplehelp-rmm-exploited-for-credential-theft-and-malware-delivery/", "date": "2026-06-30" } ] }, { "techniques": [ "credential-stuffing", "password-spraying" ], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "SOCRadar counted more than 86,644 working device credentials across 194 countries as of June 19, 2026; it describes these as confirmed-compromised devices.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [ "/blog/2026-06-23-fortibleed-campaign-used-custom-fortigate-sniffer-to-steal-credentials/", "/blog/2026-10-07-fbi-and-secret-service-warn-fortibleed-is-still-locking-out-victims/" ], "verified_on": "2026-10-31", "id": "2026-fortibleed-fortigate-credential-campaign", "name": "FortiBleed campaign harvests credentials through FortiGate devices", "victim": "Multiple: FortiGate firewall and SSL VPN operators", "industry": "cross-industry", "country": "Global", "incident_date": "2026-02", "disclosed": "2026-06-22", "actor": null, "actor_type": "financially-motivated", "initial_access": "credential-stuffing", "identity_failure": "authentication", "mfa": "unknown", "non_human": false, "summary": "SOCRadar and Hudson Rock documented FortiBleed in June 2026: an initial access broker logged in to exposed FortiGate devices with leaked or reused credentials, then ran a Go tool called FortigateSniffer to intercept authentication traffic across 24 protocols and crack the captured hashes offline, with no zero-day involved. SOCRadar tied the access to at least 12 ransomware deployments. In October 2026 the FBI and US Secret Service warned the campaign was still active and that some victims were locked out after attackers changed or deleted admin accounts.", "identity_lesson": "Edge devices accepted reused passwords for admin and VPN logins, then became a sniffer for every credential passing through. Phishing-resistant MFA on device administration and VPN, plus rotating credentials that crossed a compromised device, are the controls.", "sources": [ { "title": "FortiBleed campaign used custom FortiGate sniffer to steal credentials", "publisher": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/fortibleed-campaign-used-custom-fortigate-sniffer-to-steal-credentials/", "date": "2026-06-22" }, { "title": "FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials", "publisher": "The Hacker News", "url": "https://thehackernews.com/2026/10/fbi-warns-fortibleed-remains-active.html", "date": "2026-10-07" } ] }, { "techniques": [ "federation-trust-abuse-saml-forgery" ], "cves": [ "cve-2026-24858" ], "vendors": [], "teardown": null, "records_affected": null, "records_note": null, "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [ "/blog/2026-08-13-fortinet-sso-follow-on-24858/" ], "verified_on": "2026-10-31", "id": "2026-forticloud-sso-bypass-on-patched-fortigates", "name": "FortiCloud SSO bypass hits FortiGates already patched for CVE-2025-59718", "victim": "Multiple: FortiGate devices with FortiCloud SSO enabled", "industry": "technology", "country": "Global", "incident_date": "2026-01-15", "disclosed": "2026-01-22", "actor": null, "actor_type": "unknown", "initial_access": "identity-infra-vulnerability", "identity_failure": "directory-and-trust", "mfa": "not-applicable", "non_human": false, "summary": "Arctic Wolf reported a wave of automated FortiGate intrusions beginning January 15, 2026, in which attackers logged in through FortiCloud SSO, created admin accounts, changed VPN and firewall rules and exported configurations, including on devices running the latest release. Fortinet confirmed on January 22 that a fully upgraded device had been exploited, disabled the two FortiCloud accounts used, temporarily disabled FortiCloud SSO on January 26, and issued advisory FG-IR-26-060 for CVE-2026-24858 on January 27.", "identity_lesson": "Patching the December SAML bug did not end the trust problem in the cloud SSO path. Turning off vendor cloud SSO for device administration and alerting on new admin accounts mattered more than the patch level.", "sources": [ { "title": "Analysis of Single Sign-On Abuse on FortiOS", "publisher": "Fortinet", "url": "https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios", "date": "2026-01-22" }, { "title": "FortiGate firewalls hit by silent SSO attacks & config theft", "publisher": "The Register", "url": "https://www.theregister.com/2026/01/22/fortigate_firewalls_hit_by_silent/", "date": "2026-01-22" } ] }, { "techniques": [ "federation-trust-abuse-saml-forgery" ], "cves": [ "cve-2025-59718" ], "vendors": [], "teardown": null, "records_affected": null, "records_note": null, "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [], "verified_on": "2026-10-31", "id": "2025-fortigate-forticloud-sso-saml-bypass", "name": "FortiGate FortiCloud SSO SAML bypass used for admin logins and config theft", "victim": "Multiple: FortiGate devices with FortiCloud SSO enabled", "industry": "technology", "country": "Global", "incident_date": "2025-12-12", "disclosed": "2025-12-16", "actor": null, "actor_type": "unknown", "initial_access": "identity-infra-vulnerability", "identity_failure": "directory-and-trust", "mfa": "not-applicable", "non_human": false, "summary": "After Fortinet's December 9, 2025 advisory for CVE-2025-59718 and CVE-2025-59719, which let a crafted SAML message bypass FortiCloud SSO login, Arctic Wolf observed malicious SSO logins against FortiGate admin accounts from December 12, followed by exports of device configurations to the same IP addresses. CISA added CVE-2025-59718 to its Known Exploited Vulnerabilities catalog on December 16.", "identity_lesson": "The firewall accepted a forged SAML assertion as an admin login. Disabling cloud SSO on management interfaces until patched, restricting management access to trusted networks, and treating exported configs as exposed credentials are the controls.", "sources": [ { "title": "Fortinet FortiGate Under Active Attack Through SAML SSO Authentication Bypass", "publisher": "The Hacker News", "url": "https://thehackernews.com/2025/12/fortinet-fortigate-under-active-attack.html", "date": "2025-12-16" }, { "title": "Attackers are exploiting auth bypass vulnerability on FortiGate firewalls (CVE-2025-59718)", "publisher": "Help Net Security", "url": "https://www.helpnetsecurity.com/2025/12/17/fortigate-vulnerability-cve-2025-59718-exploited/", "date": "2025-12-17" } ] }, { "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "Neither Mixpanel nor OpenAI published a count. OpenAI said names, email addresses and approximate location of some API platform users were exposed, but no passwords, API keys or payment data.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [], "verified_on": "2026-10-31", "id": "2025-mixpanel-smishing-openai-api-users", "name": "Mixpanel smishing breach exposes OpenAI API user data", "victim": "Mixpanel and some of its customers, including OpenAI", "industry": "b2b-saas", "country": "United States", "incident_date": "2025-11-08", "disclosed": "2025-11-26", "actor": null, "actor_type": "unknown", "initial_access": "phishing-credentials", "identity_failure": "authentication", "mfa": "unknown", "non_human": false, "summary": "Mixpanel detected an SMS phishing campaign on November 8, 2025 that led to unauthorized access affecting a limited number of its customers; it revoked sessions, rotated credentials and reset all employee passwords. OpenAI disclosed in late November that a Mixpanel dataset with profile information for some platform.openai.com API users had been exported, and it ended its use of Mixpanel.", "identity_lesson": "A text message was enough to compromise an analytics vendor holding customer profile data. Phishing-resistant MFA for vendor staff, and sending vendors only the data they need, limit the downstream exposure.", "sources": [ { "title": "Our response to a recent security incident", "publisher": "Mixpanel", "url": "https://mixpanel.com/blog/sms-security-incident/", "date": "2025-11-27" }, { "title": "OpenAI admits data breach after analytics partner hit by phishing attack", "publisher": "CSO Online", "url": "https://www.csoonline.com/article/4097488/openai-admits-data-breach-after-analytics-partner-hit-by-phishing-attack-2.html", "date": "2025-11-27" } ] }, { "techniques": [ "secrets-in-repositories-and-ci" ], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "Wiz counted over 25,000 repositories carrying leaked secrets and about 700 to 800 affected packages; its preliminary count of verified credentials was 775 GitHub tokens, 373 AWS, 300 GCP and 115 Azure credentials.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [], "verified_on": "2026-10-31", "id": "2025-shai-hulud-2-npm-worm", "name": "Shai-Hulud 2.0 npm worm exposes credentials in 25,000+ repositories", "victim": "Multiple: npm maintainers and users, including Zapier, ENS Domains, PostHog and Postman packages", "industry": "technology", "country": "Global", "incident_date": "2025-11-21", "disclosed": "2025-11-24", "actor": null, "actor_type": "unknown", "initial_access": "supply-chain", "identity_failure": "non-human-identity", "mfa": "not-applicable", "non_human": true, "summary": "A second wave of the Shai-Hulud worm, uploaded to npm between November 21 and 23, 2025 and detected on November 24, ran a preinstall payload that harvested credentials from local files, environment variables, cloud metadata services and cloud secret managers. It published the stolen data to GitHub repositories, registered infected machines as self-hosted runners, and used stolen npm tokens to trojanize more packages.", "identity_lesson": "Developer and CI credentials were readable at install time and worked from anywhere. Short-lived, workload-bound credentials and blocking install scripts by default remove most of what the worm feeds on.", "sources": [ { "title": "Sha1-Hulud 2.0 Supply Chain Attack: 25K+ Repos Exposed", "publisher": "Wiz", "url": "https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack", "date": "2025-11-24" }, { "title": "\"Shai-Hulud\" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26)", "publisher": "Unit 42, Palo Alto Networks", "url": "https://unit42.paloaltonetworks.com/npm-supply-chain-attack/", "date": "2025-11-26" } ] }, { "techniques": [ "refresh-token-abuse" ], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "Google said it was aware of more than 200 potentially affected Salesforce instances; Gainsight's CEO later said only a handful of customers had data stolen. Disputed scope.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [], "verified_on": "2026-10-31", "id": "2025-gainsight-salesforce-token-abuse", "name": "Gainsight-published Salesforce app tokens abused against customer instances", "victim": "Multiple: Salesforce customers using Gainsight-published apps", "industry": "b2b-saas", "country": "Global", "incident_date": null, "disclosed": "2025-11-19", "actor": "ShinyHunters (claimed; linked by Google Threat Intelligence, per press)", "actor_type": "extortion-group", "initial_access": "oauth-token-abuse", "identity_failure": "non-human-identity", "mfa": "not-applicable", "non_human": true, "summary": "Salesforce disclosed on November 19, 2025 suspicious activity involving Gainsight-published applications connected to Salesforce, revoked all their active access and refresh tokens, and pulled the apps from AppExchange. Google Threat Intelligence said it was aware of more than 200 potentially affected Salesforce instances, and reporting tied the activity to ShinyHunters and to tokens taken in the earlier Salesloft Drift campaign.", "identity_lesson": "It was the second time in three months that a SaaS integration's OAuth tokens opened customer CRMs. Treat every connected app as a privileged non-human identity: minimal scopes, IP restrictions, short token lifetimes and monitoring for bulk API queries.", "sources": [ { "title": "Salesforce flags another third-party security incident", "publisher": "The Register", "url": "https://www.theregister.com/2025/11/20/salesforce_gainsight_breach", "date": "2025-11-20" }, { "title": "Hundreds of Salesforce customers hit by yet another third-party vendor breach", "publisher": "CyberScoop", "url": "https://cyberscoop.com/salesforce-gainsight-customers-breach/", "date": "2025-11-20" } ] }, { "techniques": [], "cves": [ "cve-2025-64446" ], "vendors": [], "teardown": null, "records_affected": null, "records_note": null, "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [], "verified_on": "2026-10-31", "id": "2025-fortiweb-cve-2025-64446-admin-creation", "name": "FortiWeb authentication bypass exploited to create rogue admin accounts", "victim": "Multiple: internet-exposed Fortinet FortiWeb appliances", "industry": "technology", "country": "Global", "incident_date": "2025-10", "disclosed": "2025-11-14", "actor": null, "actor_type": "unknown", "initial_access": "identity-infra-vulnerability", "identity_failure": "authentication", "mfa": "not-applicable", "non_human": false, "summary": "Fortinet confirmed on November 14, 2025 that CVE-2025-64446, a path traversal and authentication bypass in FortiWeb, was being exploited in the wild; CISA added it to its Known Exploited Vulnerabilities catalog the same day. Researchers had seen exploitation since early October 2025, with automated requests creating new local administrator accounts on exposed appliances.", "identity_lesson": "The management plane trusted a crafted request in place of a login. Keeping admin interfaces off the internet and alerting on any new local administrator account are the controls that catch this class of bug.", "sources": [ { "title": "Fortinet finally cops to critical bug under active exploit", "publisher": "The Register", "url": "https://www.theregister.com/2025/11/14/fortinet_active_exploit_cve_2025_64446/", "date": "2025-11-14" }, { "title": "Fortinet Confirms Active Exploitation of Critical FortiWeb Vulnerability", "publisher": "SecurityWeek", "url": "https://www.securityweek.com/fortinet-confirms-active-exploitation-of-critical-fortiweb-vulnerability/", "date": "2025-11-14" } ] }, { "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "Contact details of some customers, delivery partners and merchants; DoorDash has not published a count.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [], "verified_on": "2026-10-31", "id": "2025-doordash-employee-social-engineering", "name": "DoorDash user contact data taken after an employee was socially engineered", "victim": "DoorDash", "industry": "retail-ecommerce", "country": "United States", "incident_date": "2025-10-25", "disclosed": "2025-11-13", "actor": null, "actor_type": "unknown", "initial_access": "phishing-credentials", "identity_failure": "authentication", "mfa": "unknown", "non_human": false, "summary": "DoorDash began notifying users on November 13, 2025 that an unauthorized party had accessed internal systems after an employee fell for a social engineering scam, a problem it identified on October 25. Exposed data varied by person and included names, email addresses, phone numbers and physical addresses; DoorDash said no Social Security numbers, government IDs or payment data were accessed.", "identity_lesson": "One tricked employee opened access to contact data across customers, couriers and merchants. Phishing-resistant MFA and narrower data access per role are the controls.", "sources": [ { "title": "DoorDash confirms serious data breach - customer names, addresses, emails are more all leaked, here's what we know", "publisher": "TechRadar", "url": "https://www.techradar.com/pro/security/doordash-confirms-serious-data-breach-customer-names-addresses-emails-are-more-all-leaked-heres-what-we-know", "date": "2025-11-14" }, { "title": "DoorDash suffers data breach after social engineering attack on employee", "publisher": "CyberInsider", "url": "https://cyberinsider.com/doordash-suffers-data-breach-after-social-engineering-attack-on-employee/", "date": "2025-11-14" } ] }, { "techniques": [ "infostealer-credential-harvesting" ], "cves": [], "vendors": [], "teardown": "infostealer-session-hijacking", "records_affected": 17368, "records_note": "Employees and business partners whose names, email addresses and chat histories may have been exposed, per Nikkei.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [], "verified_on": "2026-10-31", "id": "2025-nikkei-slack-infostealer", "name": "Nikkei Slack workspace accessed with credentials stolen by malware", "victim": "Nikkei Inc.", "industry": "media-streaming", "country": "Japan", "incident_date": "2025-09", "disclosed": "2025-11-04", "actor": null, "actor_type": "unknown", "initial_access": "stolen-credentials", "identity_failure": "credential-storage", "mfa": "unknown", "non_human": false, "summary": "Nikkei disclosed in early November 2025 that malware on an employee's personal computer had leaked the user's Slack credentials, which were then used to log in to the company's Slack workspace. Nikkei detected the unauthorized access in September 2025 and said data on up to 17,368 people may have been exposed.", "identity_lesson": "Credentials harvested from an unmanaged personal device were accepted as a normal login. Device-bound or managed-device-only access to corporate SaaS, plus phishing-resistant MFA, would have refused them.", "sources": [ { "title": "Nikkei Suffers Slack Breach After Employee PC Malware Infection", "publisher": "CyberInsider", "url": "https://cyberinsider.com/nikkei-suffers-slack-breach-after-employee-pc-malware-infection/", "date": "2025-11-04" }, { "title": "Nikkei's Slack breach leaks sensitive data from more than 17,000 users", "publisher": "Computerworld", "url": "https://www.computerworld.com/article/4086194/nikkeis-slack-breach-leaks-sensitive-data-from-more-than-17000-users-2.html", "date": "2025-11-06" } ] }, { "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "The attackers claimed data on about 1.2 million students, alumni and donors; Penn has said it cannot confirm that figure.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [], "verified_on": "2026-10-31", "id": "2025-upenn-development-systems-social-engineering", "name": "University of Pennsylvania donor and alumni systems breached via identity impersonation", "victim": "University of Pennsylvania", "industry": "education", "country": "United States", "incident_date": "2025-10-31", "disclosed": "2025-10-31", "actor": null, "actor_type": "unknown", "initial_access": "phishing-credentials", "identity_failure": "authentication", "mfa": "unknown", "non_human": false, "summary": "On October 31, 2025 offensive mass emails were sent to the Penn community from university systems, and Penn said attackers had gained access to a select group of information systems related to development and alumni activities through a sophisticated identity impersonation commonly known as social engineering. Penn later confirmed that files were taken. Reporting said the attackers held an employee's PennKey single sign-on account, which reached the VPN, Salesforce, Qlik, SAP and SharePoint.", "identity_lesson": "One single sign-on account opened many systems at once. Phishing-resistant MFA without exemptions, and step-up checks before access to bulk donor data, would have limited the reach.", "sources": [ { "title": "University of Pennsylvania Confirms Data Breach Following Social Engineering Attack", "publisher": "teiss", "url": "https://www.teiss.co.uk/news/university-of-pennsylvania-confirms-data-breach-following-social-engineering-attack-16677", "date": "2025-11-09" }, { "title": "University of Pennsylvania confirms recent cyberattack led to major data theft", "publisher": "TechRadar", "url": "https://www.techradar.com/pro/security/university-of-pennsylvania-confirms-recent-cyberattack-led-to-major-data-theft", "date": "2025-11-06" } ] }, { "techniques": [ "secrets-in-repositories-and-ci" ], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "CISA said more than 500 npm packages were compromised.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [], "verified_on": "2026-10-31", "id": "2025-shai-hulud-npm-worm", "name": "Shai-Hulud self-replicating npm worm steals maintainer tokens", "victim": "Multiple: npm package maintainers and downstream users", "industry": "technology", "country": "Global", "incident_date": "2025-09", "disclosed": "2025-09-15", "actor": null, "actor_type": "unknown", "initial_access": "supply-chain", "identity_failure": "non-human-identity", "mfa": "not-applicable", "non_human": true, "summary": "In mid-September 2025 a self-replicating worm dubbed Shai-Hulud spread through npm by stealing developer credentials from infected machines, including npm tokens, GitHub personal access tokens and cloud API keys, and using the stolen npm tokens to publish trojanized versions of the victims' other packages. CISA warned on September 23, 2025 that more than 500 packages had been compromised and urged credential rotation and phishing-resistant MFA on developer accounts.", "identity_lesson": "Each stolen publish token let the worm infect a new maintainer with no human in the loop. Phishing-resistant MFA on registry accounts, short-lived publishing credentials and rotation after any exposure stop the propagation.", "sources": [ { "title": "Widespread Supply Chain Compromise Impacting npm Ecosystem", "publisher": "CISA", "url": "https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem", "date": "2025-09-23" }, { "title": "\"Shai-Hulud\" Worm Compromises npm Ecosystem in Supply Chain Attack", "publisher": "Unit 42, Palo Alto Networks", "url": "https://unit42.paloaltonetworks.com/npm-supply-chain-attack/", "date": "2025-11-26" } ] }, { "techniques": [ "secrets-in-repositories-and-ci" ], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "Wiz counted over a thousand valid GitHub tokens, dozens of valid cloud and npm credentials and about 20,000 additional files leaked; a second phase made over 5,500 private repositories public.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [], "verified_on": "2026-10-31", "id": "2025-nx-s1ngularity-npm-compromise", "name": "Nx s1ngularity npm compromise harvests developer secrets with AI CLIs", "victim": "Multiple: developers and organizations installing malicious Nx versions", "industry": "technology", "country": "Global", "incident_date": "2025-08-26", "disclosed": "2025-08-26", "actor": null, "actor_type": "unknown", "initial_access": "supply-chain", "identity_failure": "credential-storage", "mfa": "not-applicable", "non_human": true, "summary": "Malicious versions of the Nx build system and some plugins were published to npm on August 26, 2025. The Nx advisory traced the root cause to a GitHub Actions workflow open to code injection. The post-install payload collected GitHub tokens, npm config, SSH keys and wallet files, prompted installed AI command-line tools to hunt for more secrets, and uploaded the results to public repositories named s1ngularity-repository in victims' own GitHub accounts.", "identity_lesson": "Developer workstations held long-lived GitHub and npm tokens that a post-install script could read. Short-lived, scoped publishing credentials such as trusted publishing, and keeping tokens out of plaintext config, reduce what a poisoned package can take.", "sources": [ { "title": "Malicious versions of Nx and some supporting plugins were published", "publisher": "Nx (GitHub security advisory)", "url": "https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c", "date": "2025-08-27" }, { "title": "s1ngularity: supply chain attack leaks secrets on GitHub: everything you need to know", "publisher": "Wiz", "url": "https://www.wiz.io/blog/s1ngularity-supply-chain-attack", "date": "2025-08-27" } ] }, { "techniques": [ "refresh-token-abuse" ], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "Google described numerous corporate Salesforce instances and did not publish a count.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [], "verified_on": "2026-10-31", "id": "2025-salesloft-drift-oauth-token-theft", "name": "Salesloft Drift OAuth tokens used to raid Salesforce tenants", "victim": "Multiple: Salesforce customers using the Salesloft Drift integration, including Cloudflare", "industry": "b2b-saas", "country": "Global", "incident_date": "2025-08-08", "disclosed": "2025-08-20", "actor": "UNC6395 (Google Threat Intelligence)", "actor_type": "unknown", "initial_access": "oauth-token-abuse", "identity_failure": "non-human-identity", "mfa": "not-applicable", "non_human": true, "summary": "From as early as August 8 through at least August 18, 2025, UNC6395 used compromised OAuth tokens for the Salesloft Drift third-party app to query and export data from numerous corporate Salesforce instances, then searched the data for AWS access keys, passwords and Snowflake tokens. Salesloft and Salesforce revoked all Drift access and refresh tokens on August 20. Google later reported that Drift Email tokens were also used on August 9 to read mail from a very small number of Google Workspace accounts.", "identity_lesson": "A third-party integration's refresh tokens worked as standing access to hundreds of tenants with no user or MFA in the path. Inventorying connected apps, scoping and IP-restricting their tokens, and keeping secrets out of CRM records limit what one vendor breach can reach.", "sources": [ { "title": "Widespread Data Theft Targets Salesforce Instances via Salesloft Drift", "publisher": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift", "date": "2025-08-26" }, { "title": "The impact of the Salesloft Drift breach on Cloudflare and our customers", "publisher": "Cloudflare", "url": "https://blog.cloudflare.com/response-to-salesloft-drift-incident/", "date": "2025-09-02" }, { "title": "Google Warns Salesloft Drift Breach Impacts All Drift Integrations Beyond Salesforce", "publisher": "The Hacker News", "url": "https://thehackernews.com/2025/08/google-warns-salesloft-oauth-breach.html", "date": "2025-08-29" } ] }, { "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "Workday said the data was primarily commonly available business contact information and did not publish a count.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [], "verified_on": "2026-10-31", "id": "2025-workday-crm-social-engineering", "name": "Workday CRM contact data taken in a social engineering campaign", "victim": "Workday", "industry": "b2b-saas", "country": "United States", "incident_date": null, "disclosed": "2025-08-15", "actor": null, "actor_type": "unknown", "initial_access": "phishing-credentials", "identity_failure": "authentication", "mfa": "unknown", "non_human": false, "summary": "Workday said in mid-August 2025 that it had been targeted in a social engineering campaign and that threat actors accessed some information from its third-party CRM platform, mainly business contact details such as names, email addresses and phone numbers. Workday said there was no indication of access to customer tenants or the data in them, and warned the data could support follow-on scams.", "identity_lesson": "The CRM, not the core product, was the soft target. Treat CRM and support tooling as identity-critical: phishing-resistant MFA, connected-app allowlists and export alerting.", "sources": [ { "title": "Protecting You From Social Engineering Campaigns: An Update From Workday", "publisher": "Workday", "url": "https://blog.workday.com/en-us/protecting-you-from-social-engineering-campaigns-update-from-workday.html", "date": "2025-08-15" }, { "title": "Workday confirms CRM breach via social engineering", "publisher": "The Register", "url": "https://www.theregister.com/2025/08/18/workday_crm_breach/", "date": "2025-08-18" } ] }, { "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "Cisco did not disclose how many Cisco.com users were affected. No passwords were taken, per Cisco.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [], "verified_on": "2026-10-31", "id": "2025-cisco-crm-vishing", "name": "Cisco.com user profile data exported after a vishing call", "victim": "Cisco", "industry": "technology", "country": "United States", "incident_date": "2025-07-24", "disclosed": "2025-08-01", "actor": null, "actor_type": "unknown", "initial_access": "phishing-credentials", "identity_failure": "authentication", "mfa": "unknown", "non_human": false, "summary": "Cisco said that on July 24, 2025 a bad actor targeted a Cisco representative with a voice phishing call and gained access to a third-party, cloud-based CRM instance, exporting a subset of basic profile data for Cisco.com users: names, organization names, addresses, Cisco-assigned user IDs, email addresses, phone numbers and account metadata. Cisco said its products and services were not affected.", "identity_lesson": "One phone call reached a CRM holding registered-user profiles. Phishing-resistant MFA for CRM access and blocking unapproved API clients would have stopped the export.", "sources": [ { "title": "Cisco Event Response: Vishing Attack Impacting Third-Party CRM System", "publisher": "Cisco", "url": "https://sec.cloudapps.cisco.com/security/center/resources/CRM-vishing", "date": "2025-08-01" }, { "title": "Cisco disclosed a CRM data breach via vishing attack", "publisher": "Security Affairs", "url": "https://securityaffairs.com/180816/data-breach/cisco-disclosed-a-crm-data-breach-via-vishing-attack.html", "date": "2025-08-05" } ] }, { "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "Allianz Life said the majority of its roughly 1.4 million US customers were affected, plus financial professionals and some employees. No final total in the cited sources.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [], "verified_on": "2026-10-31", "id": "2025-allianz-life-crm-social-engineering", "name": "Allianz Life customer data taken from a cloud CRM via social engineering", "victim": "Allianz Life Insurance Company of North America", "industry": "insurance", "country": "United States", "incident_date": "2025-07-16", "disclosed": "2025-07-26", "actor": null, "actor_type": "unknown", "initial_access": "phishing-credentials", "identity_failure": "authentication", "mfa": "unknown", "non_human": false, "summary": "Allianz Life said that on July 16, 2025 a threat actor used a social engineering technique to obtain personally identifiable data from a third-party, cloud-based CRM system the company uses, and filed a notice with the Maine Attorney General. Allianz Life did not name the CRM vendor or the attacker.", "identity_lesson": "Access to a SaaS CRM holding customer records rested on a person who could be talked out of it. Phishing-resistant MFA, connected-app restrictions and export monitoring on the CRM are the controls.", "sources": [ { "title": "Allianz Life data breach exposed the data of most of its 1.4M customers", "publisher": "Security Affairs", "url": "https://securityaffairs.com/180445/data-breach/allianz-life-data-breach-exposed-the-data-of-most-of-its-1-4m-customers.html", "date": "2025-07-27" }, { "title": "Allianz Life says majority of 1.4 million US customers' info breached", "publisher": "Malwarebytes", "url": "https://www.malwarebytes.com/blog/news/2025/07/allianz-life-says-majority-of-1-4-million-us-customers-info-breached", "date": "2025-07-29" } ] }, { "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": 22650000, "records_note": "About 22.65 million people (customers, beneficiaries, employees and agents), per Aflac's December 2025 update.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [], "verified_on": "2026-10-31", "id": "2025-aflac-social-engineering", "name": "Aflac network intrusion attributed to social engineering", "victim": "Aflac", "industry": "insurance", "country": "United States", "incident_date": "2025-06-12", "disclosed": "2025-06-20", "actor": null, "actor_type": "extortion-group", "initial_access": "phishing-credentials", "identity_failure": "authentication", "mfa": "unknown", "non_human": false, "summary": "Aflac's Form 8-K of June 20, 2025 said it identified unauthorized access to its US network on June 12 and contained it within hours, without ransomware. Aflac said the attack was caused by a sophisticated cybercrime group as part of a campaign against the insurance industry, and press reports of its statement said the intruders used social engineering to gain access. In December 2025 Aflac said personal information of about 22.65 million people was involved, including Social Security numbers and health information.", "identity_lesson": "Social engineering of staff was enough to reach claims and health data at scale. Phishing-resistant MFA and strict verification before credential or MFA changes are the controls for this insurance-sector campaign.", "sources": [ { "title": "Aflac Incorporated Form 8-K", "publisher": "U.S. Securities and Exchange Commission", "url": "https://www.sec.gov/Archives/edgar/data/4977/000000497725000128/afl-20250620.htm", "date": "2025-06-20" }, { "title": "Aflac Reports Potential Leak of Personal Data in Breach", "publisher": "Claims Journal", "url": "https://www.claimsjournal.com/news/national/2025/06/20/331353.htm", "date": "2025-06-20" }, { "title": "Aflac hack may have exposed data of 22.6M people, company says", "publisher": "Atlanta Journal-Constitution", "url": "https://www.ajc.com/business/2025/12/hack-of-aflac-potentially-affected-more-than-22-million-people-company-says", "date": "2025-12-24" } ] }, { "techniques": [ "oauth-consent-phishing" ], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "Google did not publish a victim count. Its own affected instance held basic business contact information for small and medium businesses.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [], "verified_on": "2026-10-31", "id": "2025-unc6040-salesforce-vishing-campaign", "name": "UNC6040 voice phishing campaign against Salesforce customers", "victim": "Multiple: Salesforce customer organizations, including Google (confirmed August 5, 2025)", "industry": "cross-industry", "country": "Global", "incident_date": null, "disclosed": "2025-06-04", "actor": "UNC6040, with extortion by UNC6240, which claims the ShinyHunters name (Google Threat Intelligence)", "actor_type": "extortion-group", "initial_access": "consent-phishing", "identity_failure": "authorization", "mfa": "bypassed", "non_human": true, "summary": "Google Threat Intelligence reported on June 4, 2025 that UNC6040 was calling employees while posing as IT support and talking them into authorizing a modified Salesforce Data Loader connected app, which the actor then used to export Salesforce data for extortion. An Okta-branded phishing panel collected credentials and MFA codes during some calls. On August 5, 2025 Google added that one of its own corporate Salesforce instances had been hit by similar UNC6040 activity in June.", "identity_lesson": "A phone call converted into a trusted OAuth connection that no password reset would revoke. Restricting which connected apps users can authorize, requiring admin approval for API-enabled apps, and phishing-resistant MFA close the path.", "sources": [ { "title": "The Cost of a Call: From Voice Phishing to Data Extortion", "publisher": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion", "date": "2025-06-04" }, { "title": "Google Exposes Vishing Group UNC6040 Targeting Salesforce with Fake Data Loader App", "publisher": "The Hacker News", "url": "https://thehackernews.com/2025/06/google-exposes-vishing-group-unc6040.html", "date": "2025-06-05" } ] }, { "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": 69461, "records_note": "Individuals, per Coinbase's notice to the Maine Attorney General.", "financial_impact_usd": null, "financial_note": "Coinbase's Form 8-K of May 14, 2025 preliminarily estimated expenses of about USD 180 million to 400 million for remediation and voluntary customer reimbursements. Left null because it is a range, not a final figure.", "regulatory": null, "swi_coverage": [], "verified_on": "2026-10-31", "id": "2025-coinbase-paid-support-insiders", "name": "Coinbase customer data stolen through paid overseas support staff", "victim": "Coinbase", "industry": "crypto-web3", "country": "United States", "incident_date": null, "disclosed": "2025-05-14", "actor": null, "actor_type": "financially-motivated", "initial_access": "insider-misuse", "identity_failure": "authorization", "mfa": "not-applicable", "non_human": false, "summary": "Coinbase disclosed on May 14, 2025 that an attacker paid multiple contractors or employees in support roles outside the United States to collect customer data from internal Coinbase systems, then demanded 20 million dollars not to publish it. Coinbase said no passwords or private keys were compromised and that the data was used to impersonate Coinbase and trick customers into sending funds.", "identity_lesson": "Each support agent could look up far more customer records than any one ticket needed. Least-privilege access to customer data, per-record justification and anomaly alerts on lookup volume are the controls against a bought insider.", "sources": [ { "title": "Coinbase Global, Inc. Form 8-K", "publisher": "U.S. Securities and Exchange Commission", "url": "https://www.sec.gov/Archives/edgar/data/1679788/000167978825000094/coin-20250514.htm", "date": "2025-05-14" }, { "title": "Coinbase data breach impacted 69,461 individuals", "publisher": "Security Affairs", "url": "https://securityaffairs.com/178151/data-breach/coinbase-data-breach-impacted-69461-individuals.html", "date": "2025-05-21" } ] }, { "techniques": [ "help-desk-social-engineering" ], "cves": [], "vendors": [], "teardown": "scattered-spider-helpdesk-social-engineering", "records_affected": null, "records_note": null, "financial_impact_usd": null, "financial_note": "M&S estimated an impact of about GBP 300 million on 2025/26 group operating profit before cost mitigation, insurance and trading actions (full-year results, May 21, 2025). Not converted to USD.", "regulatory": null, "swi_coverage": [], "verified_on": "2026-10-31", "id": "2025-marks-and-spencer-third-party-impersonation", "name": "Marks & Spencer ransomware attack via impersonation of a third-party user", "victim": "Marks & Spencer", "industry": "retail-ecommerce", "country": "United Kingdom", "incident_date": "2025-04-17", "disclosed": "2025-04-22", "actor": "DragonForce (claimed); widely linked to Scattered Spider", "actor_type": "extortion-group", "initial_access": "help-desk-social-engineering", "identity_failure": "identity-lifecycle", "mfa": "unknown", "non_human": false, "summary": "M&S disclosed a cyber incident on April 22, 2025 that halted online orders for weeks. Chairman Archie Norman told MPs on July 8, 2025 that the attackers entered on April 17 through a sophisticated impersonation of one of the retailer's third-party users, and that M&S detected them two days later. The DragonForce ransomware group claimed the attack.", "identity_lesson": "The attackers talked their way into a legitimate identity rather than breaking a control. Identity verification for password and MFA resets that cannot be satisfied with personal details, applied to outsourced service desks as well as in-house staff, is the control that matters here.", "sources": [ { "title": "M&S says April cyberattack caused by 'sophisticated impersonation' of third-party", "publisher": "Irish Examiner (Reuters)", "url": "https://www.irishexaminer.com/business/companies/arid-41665775.html", "date": "2025-07-08" }, { "title": "M&S confirms social engineering led to massive ransomware attack", "publisher": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/mands-confirms-social-engineering-led-to-massive-ransomware-attack/", "date": "2025-07-08" }, { "title": "M&S estimates £300m hit to operating profit from recent cyberattack", "publisher": "Reinsurance News", "url": "https://www.reinsurancene.ws/ms-estimates-300m-hit-to-operating-profit-from-recent-cyberattack/", "date": "2025-05-21" } ] }, { "techniques": [ "secrets-in-repositories-and-ci" ], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "CISA did not publish a count of affected repositories.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [], "verified_on": "2026-10-31", "id": "2025-tj-actions-changed-files-ci-secrets", "name": "tj-actions/changed-files GitHub Action compromise leaks CI secrets", "victim": "Multiple: repositories using tj-actions/changed-files", "industry": "technology", "country": "Global", "incident_date": "2025-03-14", "disclosed": "2025-03-14", "actor": null, "actor_type": "unknown", "initial_access": "supply-chain", "identity_failure": "non-human-identity", "mfa": "not-applicable", "non_human": true, "summary": "On March 14, 2025, an attacker repointed version tags of the tj-actions/changed-files GitHub Action to a malicious commit that dumped CI runner memory and printed secrets into workflow logs, which are readable by anyone on public repositories (CVE-2025-30066). CISA said the compromise was potentially enabled by an earlier compromise of reviewdog/action-setup@v1 (CVE-2025-30154), which tj-actions workflows ran with a personal access token. Unit 42 found the campaign began as a targeted attack on Coinbase before widening.", "identity_lesson": "A personal access token reachable from a third-party action was enough to rewrite a dependency used across thousands of pipelines. Pinning actions to commit SHAs and replacing long-lived tokens with short-lived, scoped credentials limits both the entry and the leak.", "sources": [ { "title": "Supply Chain Compromise of Third-Party tj-actions/changed-files (CVE-2025-30066) and reviewdog/action-setup@v1 (CVE-2025-30154)", "publisher": "CISA", "url": "https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066", "date": "2025-03-18" }, { "title": "GitHub Actions Supply Chain Attack: A Targeted Attack on Coinbase Expanded to the Widespread tj-actions/changed-files Incident: Threat Assessment", "publisher": "Unit 42, Palo Alto Networks", "url": "https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack/", "date": "2025-03-21" }, { "title": "GitHub Action tj-actions/changed-files supply chain attack", "publisher": "Wiz", "url": "https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066", "date": "2025-03-15" } ] }, { "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "Commvault said a small number of customers it shares with Microsoft were affected and that no backup data was accessed.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [], "verified_on": "2026-10-31", "id": "2025-commvault-metallic-azure-app-secrets", "name": "Commvault Metallic breach exposes Microsoft 365 app secrets", "victim": "Commvault and a small number of its Metallic Microsoft 365 backup customers", "industry": "technology", "country": "United States", "incident_date": null, "disclosed": "2025-03-07", "actor": "Unnamed nation-state actor (per Commvault)", "actor_type": "nation-state", "initial_access": "third-party-access", "identity_failure": "non-human-identity", "mfa": "not-applicable", "non_human": true, "summary": "Commvault said Microsoft notified it on February 20, 2025 of unauthorized activity by a suspected nation-state actor in Commvault's Azure environment, where the actor had exploited a zero-day later tracked as CVE-2025-3928. On May 22, 2025 CISA said the actor may have accessed client secrets for Commvault's Metallic Microsoft 365 backup SaaS, giving potential access to customers' Microsoft 365 environments, and that the activity may be part of a broader campaign against SaaS applications with default configurations and elevated permissions.", "identity_lesson": "A vendor held standing app secrets with broad permissions into customer tenants. Customers who could rotate those secrets, restrict the service principals by location and audit their sign-ins were the ones able to contain it.", "sources": [ { "title": "Notice: Security Advisory", "publisher": "Commvault", "url": "https://www.commvault.com/blogs/security-advisory-march-7-2025", "date": "2025-03-07" }, { "title": "Advisory Update on Cyber Threat Activity Targeting Commvault's SaaS Cloud Application (Metallic)", "publisher": "CISA", "url": "https://www.cisa.gov/news-events/alerts/2025/05/22/advisory-update-cyber-threat-activity-targeting-commvaults-saas-cloud-application-metallic", "date": "2025-05-22" }, { "title": "Commvault clients should beware of campaign targeting cloud applications, CISA says", "publisher": "The Record", "url": "https://therecord.media/commvault-clients-cloud-applications-cyberthreat-cisa-alert", "date": "2025-05-23" } ] }, { "techniques": [ "token-replay-unbound-endpoint" ], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": null, "financial_impact_usd": 1500000000, "financial_note": "Approximate value of the virtual assets stolen, per the FBI public service announcement of February 26, 2025. This is stolen value, not a company-reported cost.", "regulatory": null, "swi_coverage": [], "verified_on": "2026-10-31", "id": "2025-bybit-safe-wallet-aws-session-hijack", "name": "Bybit cold-wallet theft via hijacked Safe{Wallet} developer AWS sessions", "victim": "Bybit (through a compromise of Safe{Wallet})", "industry": "crypto-web3", "country": "United Arab Emirates", "incident_date": "2025-02-04", "disclosed": "2025-02-21", "actor": "TraderTraitor (UNC4899), per the FBI and Mandiant", "actor_type": "nation-state", "initial_access": "session-token-theft", "identity_failure": "session-and-tokens", "mfa": "bypassed", "non_human": false, "summary": "On February 21, 2025, attackers drained about 1.5 billion dollars in ether from a Bybit cold wallet by serving malicious JavaScript through the Safe{Wallet} multisig interface Bybit used to sign transactions. Safe's investigation with Mandiant found a Safe developer's Mac was compromised on February 4, after which the attackers hijacked the developer's active AWS session tokens, avoiding the need to pass MFA, and altered Safe's AWS-hosted front end. The FBI attributed the theft to North Korea's TraderTraitor.", "identity_lesson": "AWS session tokens stolen from a developer laptop carried the same power as a fresh MFA login. Short-lived, device-bound sessions and separate approval for production front-end changes would have broken the chain.", "sources": [ { "title": "North Korea Responsible for $1.5 Billion Bybit Hack", "publisher": "FBI Internet Crime Complaint Center", "url": "https://www.ic3.gov/PSA/2025/PSA250226", "date": "2025-02-26" }, { "title": "Safe{Wallet} Confirms North Korean TraderTraitor Hackers Stole $1.5 Billion in Bybit Heist", "publisher": "The Hacker News", "url": "https://thehackernews.com/2025/03/safewallet-confirms-north-korean.html", "date": "2025-03-07" } ] }, { "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "PowerSchool has not published a total count of affected students and teachers.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "swi_coverage": [], "verified_on": "2026-10-31", "id": "2025-powerschool-powersource-credential", "name": "PowerSchool SIS data theft through a compromised support-portal credential", "victim": "PowerSchool", "industry": "education", "country": "United States", "incident_date": "2024-12-19", "disclosed": "2025-01-07", "actor": null, "actor_type": "financially-motivated", "initial_access": "stolen-credentials", "identity_failure": "authentication", "mfa": "unknown", "non_human": false, "summary": "PowerSchool told customers on January 7, 2025 that an attacker had used its PowerSource customer support portal to reach and export data from customers' PowerSchool student information system (SIS) instances. CrowdStrike's investigation, published in March 2025, found the actor entered PowerSource with a single compromised credential and held access from December 19 to December 28, 2024, and that the same credential had also been used to access PowerSchool's network between August and September 2024.", "identity_lesson": "A support portal with maintenance access into every customer's SIS was protected by a reusable credential. Phishing-resistant MFA and network restriction on vendor support access, plus alerting on bulk exports, would have narrowed the blast radius.", "sources": [ { "title": "PowerSchool Cybersecurity Incident", "publisher": "PowerSchool", "url": "https://www.powerschool.com/security/sis-incident/", "date": "2025-03-07" }, { "title": "PowerSchool Portal Compromised Months Before Massive Data Breach", "publisher": "SecurityWeek", "url": "https://www.securityweek.com/powerschool-portal-compromised-months-before-massive-data-breach/", "date": "2025-03-12" } ] }, { "id": "2024-us-treasury-beyondtrust-api-key", "name": "US Treasury workstations accessed through a stolen BeyondTrust Remote Support key", "victim": "US Department of the Treasury", "industry": "government", "country": "United States", "incident_date": "2024-12", "disclosed": "2024-12-30", "actor": "China state-sponsored APT (unnamed by Treasury)", "actor_type": "nation-state", "initial_access": "third-party-access", "identity_failure": "non-human-identity", "mfa": "not-applicable", "non_human": true, "techniques": [ "static-api-key-abuse" ], "cves": [], "vendors": [ "pam/beyondtrust" ], "teardown": null, "records_affected": null, "records_note": "Treasury said certain unclassified documents on accessed workstations were retrieved.", "financial_impact_usd": null, "financial_note": null, "regulatory": "Treasury reported the intrusion to Congress as a major cybersecurity incident in a December 30, 2024 letter to Senate Banking Committee leaders.", "summary": "On December 8, 2024 BeyondTrust told Treasury that an attacker had obtained a key BeyondTrust used to secure a cloud service for its Remote Support SaaS. With it, the attacker bypassed the service's security, remotely accessed some Treasury workstations and took unclassified documents. Treasury attributed the intrusion to a China state-sponsored actor in a December 30 letter to Congress; BeyondTrust had disclosed CVE-2024-12356 and CVE-2024-12686 that month but has not said how they figured in the attack.", "identity_lesson": "A single vendor-held key opened remote access into customer endpoints. Remote support tools are privileged access paths that need short-lived, scoped credentials and customer-side approval for each session.", "sources": [ { "title": "Treasury Department breached through BeyondTrust service", "publisher": "TechTarget", "url": "https://www.techtarget.com/news/Treasury-Department-breached-through-BeyondTrust-service/836788/", "date": "2024-12-31" }, { "title": "Chinese-sponsored hackers accessed Treasury documents in 'major incident'", "publisher": "Nextgov/FCW", "url": "https://www.nextgov.com/cybersecurity/2024/12/chinese-sponsored-hackers-accessed-treasury-documents-major-incident/401899/", "date": "2024-12-30" } ], "verified_on": "2026-10-31" }, { "id": "2024-cyberhaven-chrome-extension-oauth-consent-phishing", "name": "Cyberhaven Chrome extension hijacked through OAuth consent phishing", "victim": "Cyberhaven", "industry": "technology", "country": "United States", "incident_date": "2024-12-24", "disclosed": "2024-12-27", "actor": null, "actor_type": "unknown", "initial_access": "consent-phishing", "identity_failure": "authorization", "mfa": "bypassed", "non_human": true, "techniques": [ "oauth-consent-phishing" ], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": null, "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "On December 24, 2024 a Cyberhaven employee received a phishing email posing as Chrome Web Store support and authorized a malicious OAuth app, Privacy Policy Extension, which gave the attacker access to the company's Chrome Web Store account. The attacker published malicious extension version 24.10.4 and Cyberhaven disclosed on December 27. Cyberhaven said the employee had Google Advanced Protection and MFA, received no MFA prompt, and did not have their Google credentials stolen; researchers tied it to a wider campaign against extension developers.", "identity_lesson": "OAuth consent grants access without a password or MFA challenge. Admin-controlled app consent policies that block unverified third-party apps from sensitive scopes would have stopped the grant.", "sources": [ { "title": "Dozens of Chrome extensions hacked in threat campaign", "publisher": "TechTarget", "url": "https://www.techtarget.com/news/Dozens-of-Chrome-extensions-hacked-in-threat-campaign/836786/", "date": "2024-12-30" }, { "title": "Several Chrome extensions compromised in supply chain attack", "publisher": "SecurityWeek", "url": "https://www.securityweek.com/several-chrome-extensions-compromised-in-supply-chain-attack/", "date": "2024-12-30" } ], "verified_on": "2026-10-31" }, { "id": "2024-internet-archive-exposed-gitlab-zendesk-tokens", "name": "Internet Archive user database theft and Zendesk token abuse", "victim": "Internet Archive", "industry": "technology", "country": "United States", "incident_date": null, "disclosed": "2024-10-09", "actor": null, "actor_type": "unknown", "initial_access": "exposed-secrets", "identity_failure": "credential-storage", "mfa": "not-applicable", "non_human": true, "techniques": [ "secrets-in-repositories-and-ci", "static-api-key-abuse" ], "cves": [], "vendors": [], "teardown": null, "records_affected": 31000000, "records_note": "About 31 million user accounts (emails, screen names, bcrypt password hashes), as reported by The Verge from the Have I Been Pwned listing.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "On October 9, 2024 the Internet Archive was defaced with a message announcing the theft of its user database, about 31 million accounts, while also under DDoS. On October 20 an attacker sent emails through the Archive's Zendesk using a still-valid API token, showing access to support tickets. BleepingComputer, as cited by Infosecurity Magazine, reported that the attacker first obtained an exposed GitLab configuration file containing an authentication token, used it to download source code, and found Zendesk tokens there that had not been rotated.", "identity_lesson": "A token left in a development server's configuration opened the source code, and tokens in that code opened everything else. Secret scanning and rotating every exposed token after the first breach would have stopped the second one.", "sources": [ { "title": "The Internet Archive is under attack, with a breach revealing info for 31 million accounts", "publisher": "The Verge", "url": "https://www.theverge.com/2024/10/9/24266419/internet-archive-ddos-attack-pop-up-message", "date": "2024-10-09" }, { "title": "Stolen access tokens lead to new Internet Archive breach", "publisher": "Infosecurity Magazine", "url": "https://www.infosecurity-magazine.com/news/stolen-tokens-internet-archive/", "date": "2024-10-21" }, { "title": "Learning from cyberattacks", "publisher": "Internet Archive", "url": "https://blog.archive.org/2024/11/14/learning-from-cyberattacks/", "date": "2024-11-14" } ], "verified_on": "2026-10-31" }, { "id": "2024-disney-slack-employee-infostealer", "name": "Disney Slack data theft using credentials stolen from an employee's personal computer", "victim": "The Walt Disney Company", "industry": "media-streaming", "country": "United States", "incident_date": "2024-05", "disclosed": "2024-07-15", "actor": "NullBulge (Ryan Mitchell Kramer)", "actor_type": "financially-motivated", "initial_access": "stolen-credentials", "identity_failure": "credential-storage", "mfa": "unknown", "non_human": false, "techniques": [ "infostealer-credential-harvesting" ], "cves": [], "vendors": [], "teardown": "infostealer-session-hijacking", "records_affected": null, "records_note": "About 1.1 TB of data from thousands of Disney Slack channels, per the US Attorney's Office.", "financial_impact_usd": null, "financial_note": null, "regulatory": "Ryan Mitchell Kramer agreed to plead guilty to accessing a computer to obtain information and threatening to damage a protected computer (US Attorney, Central District of California, May 2025).", "summary": "A Disney employee downloaded a trojanized AI art tool to a personal computer in 2024; the malware gave the attacker credentials stored on that machine, which he used to log into the employee's Disney Slack account. In May 2024 he downloaded about 1.1 TB from thousands of Slack channels, and in July 2024, claiming to be part of the hacktivist group NullBulge, released it after the employee did not respond to extortion.", "identity_lesson": "Work credentials synced to a personal, unmanaged computer put corporate access at the mercy of whatever that computer runs. Managed-device requirements for SaaS sign-in and phishing-resistant MFA would have made the stolen credentials insufficient.", "sources": [ { "title": "Santa Clarita man agrees to plead guilty to hacking Disney employee's computer, downloading confidential data from company", "publisher": "US Attorney's Office, Central District of California", "url": "https://www.justice.gov/usao-cdca/pr/santa-clarita-man-agrees-plead-guilty-hacking-disney-employees-computer-downloading", "date": "2025-05-01" } ], "verified_on": "2026-10-31" }, { "id": "2024-att-snowflake-call-records", "name": "AT&T call and text records stolen from its Snowflake workspace", "victim": "AT&T", "industry": "telecom", "country": "United States", "incident_date": "2024-04-14", "disclosed": "2024-07-12", "actor": null, "actor_type": "financially-motivated", "initial_access": "stolen-credentials", "identity_failure": "authentication", "mfa": "absent", "non_human": false, "techniques": [ "infostealer-credential-harvesting" ], "cves": [], "vendors": [], "teardown": "snowflake-2024-credential-attacks", "records_affected": 110000000, "records_note": "Nearly all AT&T wireless customers and MVNO customers on its network for May to October 2022 and January 2, 2023, per the 8-K; press reported about 110 million people.", "financial_impact_usd": null, "financial_note": null, "regulatory": "The US Department of Justice twice authorized AT&T to delay public disclosure under Form 8-K Item 1.05(c), on May 9 and June 5, 2024.", "summary": "AT&T said in a July 12, 2024 8-K that between April 14 and April 25, 2024 threat actors accessed an AT&T workspace on a third-party cloud platform, which AT&T confirmed to press was Snowflake, and exfiltrated records of calls and texts for nearly all its wireless customers from mid-2022. The records held phone numbers, interaction counts, durations and some cell site IDs, not content.", "identity_lesson": "Metadata on more than 100 million people sat behind a single-factor login to an analytics workspace; MFA and network allow lists on that account were the missing controls.", "sources": [ { "title": "AT&T Form 8-K (Item 1.05)", "publisher": "US SEC", "url": "https://www.sec.gov/Archives/edgar/data/732717/000073271724000046/t-20240506.htm", "date": "2024-07-12" }, { "title": "AT&T disclosed a new data breach that exposed call logs of almost all customers", "publisher": "Security Affairs", "url": "https://securityaffairs.com/165658/data-breach/att-disclosed-a-new-data-breach.html", "date": "2024-07-12" } ], "swi_coverage": [ "/blog/2026-08-06-snowflake-hacker-connor-moucka-pleads-guilty/" ], "verified_on": "2026-10-31" }, { "id": "2024-twilio-authy-unauthenticated-endpoint", "name": "Authy phone numbers enumerated through an unauthenticated endpoint", "victim": "Twilio (Authy)", "industry": "b2b-saas", "country": "United States", "incident_date": "2024-06", "disclosed": "2024-07-01", "actor": "ShinyHunters (claimed)", "actor_type": "financially-motivated", "initial_access": "identity-infra-vulnerability", "identity_failure": "authentication", "mfa": "not-applicable", "non_human": false, "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "Attackers claimed 33 million phone numbers; Twilio did not confirm a count.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "In late June 2024 ShinyHunters posted about 33 million phone numbers it said were tied to Authy accounts. Twilio confirmed attackers had identified data associated with Authy accounts, including phone numbers, through an unauthenticated endpoint, secured it, and urged users to update the Authy apps. Twilio said it found no evidence of access to its systems or other sensitive data.", "identity_lesson": "MFA providers are targets in their own right. An API that confirms whether a phone number has an account, without authentication or rate limits, hands attackers a list of people to SIM-swap or phish.", "sources": [ { "title": "Security alert: Authy app (Android and iOS)", "publisher": "Twilio", "url": "https://www.twilio.com/en-us/changelog/Security_Alert_Authy_App_Android_iOS", "date": "2024-07-01" }, { "title": "Twilio confirms data breach after hackers leak 33M Authy user phone numbers", "publisher": "SecurityWeek", "url": "https://www.securityweek.com/twilio-confirms-data-breach-after-hackers-leak-33m-authy-user-phone-numbers/", "date": "2024-07-04" } ], "verified_on": "2026-10-31" }, { "id": "2024-teamviewer-apt29-employee-account", "name": "TeamViewer corporate IT intrusion via a compromised employee account", "victim": "TeamViewer", "industry": "technology", "country": "Germany", "incident_date": "2024-06-26", "disclosed": "2024-06-27", "actor": "APT29 (Midnight Blizzard)", "actor_type": "nation-state", "initial_access": "stolen-credentials", "identity_failure": "authentication", "mfa": "unknown", "non_human": false, "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "Employee directory data (names, corporate contact details, encrypted employee passwords), per TeamViewer.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "TeamViewer detected an irregularity in its internal corporate IT environment on June 26, 2024, disclosed it the next day, and attributed it to APT29 (Midnight Blizzard). The attacker used credentials of a standard employee account to copy employee directory data, including encrypted employee passwords. TeamViewer said the product environment, connectivity platform and customer data were not affected, and closed the investigation on July 4.", "identity_lesson": "A standard employee login reached the corporate directory. Phishing-resistant MFA and segmentation between corporate IT and the product environment, which TeamViewer credits with containment, are the controls that mattered.", "sources": [ { "title": "Security bulletin TV-2024-1005: statement on corporate IT environment", "publisher": "TeamViewer", "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2024-1005/", "date": "2024-06-27" } ], "verified_on": "2026-10-31" }, { "id": "2024-neiman-marcus-snowflake-account", "name": "Neiman Marcus customer data stolen from its Snowflake account", "victim": "Neiman Marcus Group", "industry": "retail-ecommerce", "country": "United States", "incident_date": "2024-04", "disclosed": "2024-06-24", "actor": null, "actor_type": "financially-motivated", "initial_access": "stolen-credentials", "identity_failure": "authentication", "mfa": "absent", "non_human": false, "techniques": [ "infostealer-credential-harvesting" ], "cves": [], "vendors": [], "teardown": "snowflake-2024-credential-attacks", "records_affected": 64472, "records_note": "People notified, per the company's filing with the Maine attorney general. Press later reported the stolen data contained far more email addresses.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "Neiman Marcus notified 64,472 people in June 2024 that names, contact details, dates of birth and gift card numbers were taken from a third-party cloud database between April and May 2024, and confirmed to press that it was its Snowflake account. The data had been advertised for sale by the same actors behind the wider Snowflake campaign.", "identity_lesson": "Same failure as the wider Snowflake campaign: an account reachable from anywhere with a stolen password and no second factor.", "sources": [ { "title": "Neiman Marcus confirms data breach, claims its Snowflake account was hacked", "publisher": "TechRadar", "url": "https://www.techradar.com/pro/security/neiman-marcus-confirms-data-breach-claims-its-snowflake-account-was-hacked", "date": "2024-06-25" } ], "swi_coverage": [ "/blog/2026-08-06-snowflake-hacker-connor-moucka-pleads-guilty/" ], "verified_on": "2026-10-31" }, { "id": "2024-advance-auto-parts-snowflake-account", "name": "Advance Auto Parts job applicant data stolen from its Snowflake account", "victim": "Advance Auto Parts", "industry": "retail-ecommerce", "country": "United States", "incident_date": "2024-04-14", "disclosed": "2024-06-14", "actor": null, "actor_type": "financially-motivated", "initial_access": "stolen-credentials", "identity_failure": "authentication", "mfa": "absent", "non_human": false, "techniques": [ "infostealer-credential-harvesting" ], "cves": [], "vendors": [], "teardown": "snowflake-2024-credential-attacks", "records_affected": 2316591, "records_note": "Individuals (current and former job applicants and employees), per the company's filing with the Maine attorney general.", "financial_impact_usd": 3000000, "financial_note": "Expected expense of about $3 million for the quarter ending July 13, 2024, per the June 2024 8-K (costs largely within its cyber insurance retention).", "regulatory": null, "summary": "Advance Auto Parts found unauthorized activity in a third-party cloud database on May 23, 2024, and a criminal offered its data for sale on June 4. The company later confirmed the data came from its Snowflake environment and notified 2,316,591 people in July 2024 that names, Social Security numbers, driver's license numbers and dates of birth from job application records may have been taken.", "identity_lesson": "Applicant data held in an analytics platform was protected by a password alone; MFA on the Snowflake account was the missing control.", "sources": [ { "title": "Advance Auto Parts Form 8-K (Item 8.01)", "publisher": "US SEC", "url": "https://www.sec.gov/Archives/edgar/data/1158449/000115844924000162/aap-20240523.htm", "date": "2024-06-14" }, { "title": "Advance Auto Parts data breach affected more than 2 million people", "publisher": "The Record", "url": "https://therecord.media/advance-auto-parts-data-breach-2million", "date": "2024-07-11" } ], "swi_coverage": [ "/blog/2026-08-06-snowflake-hacker-connor-moucka-pleads-guilty/" ], "verified_on": "2026-10-31" }, { "id": "2024-new-york-times-exposed-github-token", "name": "New York Times source code stolen with an exposed GitHub credential", "victim": "The New York Times", "industry": "media-streaming", "country": "United States", "incident_date": "2024-01", "disclosed": "2024-06-10", "actor": null, "actor_type": "unknown", "initial_access": "exposed-secrets", "identity_failure": "credential-storage", "mfa": "not-applicable", "non_human": true, "techniques": [ "secrets-in-repositories-and-ci" ], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "An archive of about 273 GB of internal repositories was posted online, per press reports.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "In June 2024 a user posted about 273 GB of New York Times internal source code on 4chan. The Times confirmed that a credential for a third-party code platform, later confirmed to be GitHub, had been inadvertently exposed in January 2024 and used to take the repositories, and said its internal systems and operations were not affected.", "identity_lesson": "An exposed token with read access to an organization's repositories is a source code breach waiting for someone to notice. Secret scanning with immediate revocation, and fine-grained short-lived tokens, close the window.", "sources": [ { "title": "New York Times plays down impact of source code leak", "publisher": "CSO Online", "url": "https://www.csoonline.com/article/2140389/new-york-times-plays-down-impact-of-source-code-leak.html", "date": "2024-06-10" }, { "title": "New York Times responds to source code leak", "publisher": "SecurityWeek", "url": "https://www.securityweek.com/new-york-times-responds-to-source-code-leak/", "date": "2024-06-10" } ], "verified_on": "2026-10-31" }, { "id": "2024-snowflake-customer-tenant-campaign", "name": "Snowflake customer tenant extortion campaign (UNC5537)", "victim": "Multiple: about 165 Snowflake customers", "industry": "cross-industry", "country": "Global", "incident_date": "2024-04", "disclosed": "2024-05-31", "actor": "UNC5537", "actor_type": "financially-motivated", "initial_access": "stolen-credentials", "identity_failure": "authentication", "mfa": "absent", "non_human": false, "techniques": [ "infostealer-credential-harvesting", "credential-stuffing" ], "cves": [], "vendors": [], "teardown": "snowflake-2024-credential-attacks", "records_affected": null, "records_note": "Campaign-level total not published by Snowflake or Mandiant; see the individual victim records.", "financial_impact_usd": null, "financial_note": null, "regulatory": "Connor Moucka pleaded guilty in US federal court on August 6, 2026; see the teardown for case details.", "summary": "Starting in April 2024, UNC5537 logged into about 165 Snowflake customer accounts with credentials stolen by infostealer malware, some as far back as 2020, then stole data and extorted the victims. Snowflake first warned of identity-based attacks on customer accounts on May 31, 2024, and Mandiant's June 10 report found no breach of Snowflake's own platform: the affected accounts lacked MFA, had not rotated credentials, and had no network allow lists.", "identity_lesson": "The platform was not hacked; single-factor logins were. Enforced MFA, credential rotation and network policies on data platform accounts would have stopped every login in the campaign.", "sources": [ { "title": "UNC5537 targets Snowflake customer instances for data theft and extortion", "publisher": "Google Cloud (Mandiant)", "url": "https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion", "date": "2024-06-10" }, { "title": "Detecting and preventing unauthorized user access", "publisher": "Snowflake", "url": "https://community.snowflake.com/s/question/0D5VI00000Emyl00AB/detecting-and-preventing-unauthorized-user-access", "date": "2024-05-31" } ], "swi_coverage": [ "/blog/2026-08-06-snowflake-hacker-connor-moucka-pleads-guilty/" ], "verified_on": "2026-10-31" }, { "id": "2024-ticketmaster-snowflake-account", "name": "Ticketmaster customer data stolen from its Snowflake account", "victim": "Live Nation Entertainment (Ticketmaster)", "industry": "media-streaming", "country": "United States", "incident_date": "2024-04", "disclosed": "2024-05-31", "actor": null, "actor_type": "financially-motivated", "initial_access": "stolen-credentials", "identity_failure": "authentication", "mfa": "absent", "non_human": false, "techniques": [ "infostealer-credential-harvesting" ], "cves": [], "vendors": [], "teardown": "snowflake-2024-credential-attacks", "records_affected": null, "records_note": "Ticketmaster did not disclose a total; the 560 million figure is the seller's unverified claim.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "Live Nation said in a May 31, 2024 8-K that on May 20 it found unauthorized activity in a third-party cloud database holding mostly Ticketmaster data, after a criminal offered the data for sale on May 27. Ticketmaster later confirmed the provider was Snowflake and began notifying customers that names, contact details and encrypted card data may have been taken. It was one of the victims in the wider Snowflake campaign.", "identity_lesson": "Same failure as the wider Snowflake campaign: a reachable data platform account with no MFA and long-lived credentials.", "sources": [ { "title": "Live Nation Entertainment Form 8-K (Item 8.01)", "publisher": "US SEC", "url": "https://www.sec.gov/Archives/edgar/data/1335258/000133525824000081/lyv-20240520.htm", "date": "2024-05-31" }, { "title": "Ticketmaster confirms data breach and personal info lost, says Snowflake systems were hacked", "publisher": "TechRadar", "url": "https://www.techradar.com/pro/security/ticketmaster-confirms-data-breach-and-personal-info-lost-says-snowflake-systems-were-hacked", "date": "2024-06-28" } ], "swi_coverage": [ "/blog/2026-08-06-snowflake-hacker-connor-moucka-pleads-guilty/" ], "verified_on": "2026-10-31" }, { "id": "2024-dropbox-sign-service-account-compromise", "name": "Dropbox Sign production breach via a compromised service account", "victim": "Dropbox (Dropbox Sign)", "industry": "b2b-saas", "country": "United States", "incident_date": "2024-04", "disclosed": "2024-05-01", "actor": null, "actor_type": "unknown", "initial_access": "stolen-credentials", "identity_failure": "non-human-identity", "mfa": "not-applicable", "non_human": true, "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "Dropbox said data for all Dropbox Sign users was accessed; it did not publish a count.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "On April 24, 2024 Dropbox detected unauthorized access to the Dropbox Sign (formerly HelloSign) production environment. The attacker compromised a service account in Sign's automated system configuration tool, which had privileges to act in production, and reached the customer database: emails, usernames, phone numbers, hashed passwords, and for some users API keys, OAuth tokens and MFA data. Dropbox disclosed in an 8-K on May 1, 2024, and rotated API keys and OAuth tokens.", "identity_lesson": "An automation service account with broad production privileges is a human admin without the human controls. Least-privilege scoping and monitoring of service account use would have shrunk what one compromise exposed.", "sources": [ { "title": "Dropbox Form 8-K (Item 1.05)", "publisher": "US SEC", "url": "https://www.sec.gov/Archives/edgar/data/1467623/000146762324000024/dbx-20240429.htm", "date": "2024-05-01" }, { "title": "A recent security incident involving Dropbox Sign", "publisher": "Dropbox", "url": "https://sign.dropbox.com/blog/a-recent-security-incident-involving-dropbox-sign", "date": "2024-05-01" } ], "verified_on": "2026-10-31" }, { "id": "2024-mitre-nerve-ivanti-session-hijack", "name": "MITRE NERVE network breached via Ivanti zero-days and session hijacking", "victim": "MITRE", "industry": "government", "country": "United States", "incident_date": "2024-01", "disclosed": "2024-04-19", "actor": null, "actor_type": "nation-state", "initial_access": "identity-infra-vulnerability", "identity_failure": "session-and-tokens", "mfa": "bypassed", "non_human": false, "techniques": [ "session-cookie-theft" ], "cves": [ "cve-2023-46805" ], "vendors": [], "teardown": null, "records_affected": null, "records_note": null, "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "MITRE disclosed on April 19, 2024 that a foreign nation-state actor breached NERVE, its unclassified research and prototyping network, starting in January 2024. The attacker exploited two Ivanti Connect Secure zero-days, CVE-2023-46805 and CVE-2024-21887, hijacked VPN sessions to get past MFA and move laterally into MITRE's VMware infrastructure, and used compromised accounts including an administrator account. MITRE did not name the actor.", "identity_lesson": "MFA at the VPN does not survive a hijacked session or an auth bypass in the gateway itself. Session binding, rapid patching of remote access appliances and re-authentication before admin actions inside the network would have narrowed the path.", "sources": [ { "title": "MITRE breached by nation-state threat actor via Ivanti zero-days", "publisher": "Help Net Security", "url": "https://www.helpnetsecurity.com/2024/04/22/mitre-breached/", "date": "2024-04-22" }, { "title": "MITRE hacked by state-sponsored group via Ivanti zero-days", "publisher": "SecurityWeek", "url": "https://www.securityweek.com/mitre-hacked-by-state-sponsored-group-via-ivanti-zero-days/", "date": "2024-04-22" } ], "verified_on": "2026-10-31" }, { "id": "2024-cisco-duo-telephony-provider-phishing", "name": "Cisco Duo SMS MFA logs stolen from a phished telephony provider", "victim": "Cisco Duo (via an unnamed telephony provider)", "industry": "technology", "country": "United States", "incident_date": "2024-04-01", "disclosed": "2024-04-15", "actor": null, "actor_type": "unknown", "initial_access": "third-party-access", "identity_failure": "authentication", "mfa": "unknown", "non_human": false, "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "Cisco told press about 1 percent of Duo customers were affected; no individual count was published.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "On April 1, 2024 an attacker used credentials phished from an employee of the telephony provider that delivers Duo's SMS and VoIP MFA messages, and downloaded message logs for certain Duo accounts covering March 1 to March 31, 2024. The logs held phone numbers, carriers, locations and timestamps but not message content. Cisco notified affected customers on April 15 and warned of follow-on phishing.", "identity_lesson": "SMS MFA depends on telecom suppliers whose own staff logins become part of your identity attack surface; their phishable access exposed MFA metadata for Duo customers.", "sources": [ { "title": "Cisco Duo provider breached, SMS MFA logs compromised", "publisher": "Help Net Security", "url": "https://www.helpnetsecurity.com/2024/04/16/duo-compromise-mfa-sms/", "date": "2024-04-16" }, { "title": "Cisco Duo says hack at telephony supplier exposed MFA SMS logs", "publisher": "SecurityWeek", "url": "https://www.securityweek.com/cisco-duo-says-hack-at-telephony-supplier-exposed-mfa-sms-logs/", "date": "2024-04-15" } ], "verified_on": "2026-10-31" }, { "id": "2024-sisense-gitlab-token-customer-credentials", "name": "Sisense breach exposing customer credentials, prompting a CISA alert", "victim": "Sisense", "industry": "b2b-saas", "country": "United States", "incident_date": null, "disclosed": "2024-04-11", "actor": null, "actor_type": "unknown", "initial_access": "exposed-secrets", "identity_failure": "credential-storage", "mfa": "not-applicable", "non_human": true, "techniques": [ "secrets-in-repositories-and-ci" ], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": null, "financial_impact_usd": null, "financial_note": null, "regulatory": "CISA issued an alert on April 11, 2024 urging Sisense customers to reset credentials and secrets potentially exposed to or used to access Sisense services.", "summary": "In April 2024 analytics vendor Sisense told customers to rotate credentials, and CISA issued an alert after independent researchers and CISA found compromised Sisense data affecting critical infrastructure organizations. KrebsOnSecurity, citing sources, reported that attackers reached Sisense's self-managed GitLab, where a hard-coded token gave access to Amazon S3 buckets holding customer access tokens, passwords and certificates. Sisense did not publicly confirm the access path.", "identity_lesson": "A vendor that stores customers' integration secrets concentrates risk. Keeping tokens out of code, scoping cloud keys narrowly and favoring short-lived federated credentials over stored passwords would have limited the blast radius.", "sources": [ { "title": "Compromise of Sisense customer data", "publisher": "CISA", "url": "https://www.cisa.gov/news-events/alerts/2024/04/11/compromise-sisense-customer-data", "date": "2024-04-11" }, { "title": "Why CISA is warning CISOs about a breach at Sisense", "publisher": "KrebsOnSecurity", "url": "https://krebsonsecurity.com/2024/04/why-cisa-is-warning-cisos-about-a-breach-at-sisense/", "date": "2024-04-11" } ], "verified_on": "2026-10-31" }, { "id": "2024-roku-credential-stuffing", "name": "Roku account credential stuffing in two waves", "victim": "Roku", "industry": "media-streaming", "country": "United States", "incident_date": "2023-12", "disclosed": "2024-03-08", "actor": null, "actor_type": "financially-motivated", "initial_access": "credential-stuffing", "identity_failure": "authentication", "mfa": "absent", "non_human": false, "techniques": [ "credential-stuffing" ], "cves": [], "vendors": [], "teardown": null, "records_affected": 591363, "records_note": "Accounts: 15,363 in the first incident (March 2024) plus about 576,000 in the second (April 2024), per Roku. Fewer than 400 had unauthorized purchases.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "Roku disclosed on March 8, 2024 that 15,363 accounts had been accessed with credentials stolen from other sites, and on April 12 that about 576,000 more were hit in a second wave found while investigating the first. Attackers used some accounts to buy streaming subscriptions and hardware with stored payment methods. Roku reset passwords and turned on two-factor authentication for all accounts.", "identity_lesson": "Roku's own fix, mandatory 2FA for every account, is the control that would have prevented both waves.", "sources": [ { "title": "An important update regarding Roku accounts", "publisher": "Roku", "url": "https://newsroom.roku.com/news/2024/03/an-important-update-regarding-roku-accounts/", "date": "2024-03-08" }, { "title": "An update on our security incident", "publisher": "Roku", "url": "https://newsroom.roku.com/news/2024/04/an-update-on-our-security-incident/", "date": "2024-04-12" }, { "title": "Roku disclosed a new security breach impacting 576,000 accounts", "publisher": "Security Affairs", "url": "https://securityaffairs.com/161765/data-breach/roku-second-data-breach.html", "date": "2024-04-12" } ], "verified_on": "2026-10-31" }, { "id": "2024-change-healthcare-citrix-no-mfa", "name": "Change Healthcare ransomware via a Citrix remote access portal without MFA", "victim": "Change Healthcare (UnitedHealth Group)", "industry": "healthcare", "country": "United States", "incident_date": "2024-02-12", "disclosed": "2024-02-22", "actor": "ALPHV/BlackCat affiliate", "actor_type": "extortion-group", "initial_access": "stolen-credentials", "identity_failure": "authentication", "mfa": "absent", "non_human": false, "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": 192700000, "records_note": "Individuals, per Change Healthcare's updated filing with HHS OCR (July 2025). UnitedHealth's 2024 10-K estimated about 190 million; the count is not fully deduplicated.", "financial_impact_usd": 3067000000, "financial_note": "UnitedHealth's 2024 10-K: $2.2 billion of direct response costs plus $867 million of estimated Optum Insight business disruption for 2024. Excludes later years.", "regulatory": null, "summary": "On February 12, 2024 attackers used compromised credentials to log into a Change Healthcare Citrix remote access portal that did not have MFA, moved laterally, exfiltrated data and deployed ransomware on February 21. UnitedHealth disclosed in an 8-K on February 22; the outage disrupted claims and pharmacy payments across the US health system for weeks. CEO Andrew Witty confirmed the missing MFA in written testimony to Congress released April 30, 2024.", "identity_lesson": "One remote access portal without MFA was the entry point for data on about 190 million people. Enforcing MFA on every externally reachable login, with no legacy exceptions, would have changed the outcome.", "sources": [ { "title": "UnitedHealth Group Form 8-K (Item 1.05)", "publisher": "US SEC", "url": "https://www.sec.gov/Archives/edgar/data/731766/000073176624000045/unh-20240221.htm", "date": "2024-02-22" }, { "title": "UnitedHealth Group Form 10-K for 2024", "publisher": "US SEC", "url": "https://www.sec.gov/Archives/edgar/data/731766/000073176625000063/unh-20241231.htm", "date": "2025-02-27" }, { "title": "Change Healthcare revises breach impact to 192.7 million individuals", "publisher": "CyberInsider", "url": "https://cyberinsider.com/change-healthcare-revises-breach-impact-to-192-7-million-individuals/", "date": "2025-08-01" }, { "title": "UnitedHealth Group updates on Change Healthcare cyberattack", "publisher": "UnitedHealth Group", "url": "https://www.unitedhealthgroup.com/newsroom/2024/2024-04-22-uhg-updates-on-change-healthcare-cyberattack.html", "date": "2024-04-22" }, { "title": "Change Healthcare breached via Citrix portal with no MFA", "publisher": "TechTarget", "url": "https://www.techtarget.com/news/Change-Healthcare-breached-via-Citrix-portal-with-no-MFA/837237/", "date": "2024-04-30" }, { "title": "UnitedHealth CEO tells Congress hackers used stolen credentials", "publisher": "The Record", "url": "https://therecord.media/unitedhealth-group-change-healthcare-ransomware-congress", "date": "2024-04-30" } ], "verified_on": "2026-10-31" }, { "id": "2024-cloudflare-unrotated-okta-breach-credentials", "name": "Cloudflare Atlassian intrusion with credentials left unrotated after the Okta breach", "victim": "Cloudflare", "industry": "technology", "country": "United States", "incident_date": "2023-11-14", "disclosed": "2024-02-01", "actor": null, "actor_type": "nation-state", "initial_access": "stolen-credentials", "identity_failure": "non-human-identity", "mfa": "not-applicable", "non_human": true, "techniques": [ "static-api-key-abuse" ], "cves": [], "vendors": [], "teardown": "okta-2023-support-system-breach", "records_affected": null, "records_note": "Cloudflare said no customer data or systems were affected.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "From November 14 to November 24, 2023 an attacker Cloudflare believes was a nation state used one access token and three service account credentials taken in the October 2023 Okta support breach, which Cloudflare had failed to rotate, to reach its Atlassian Confluence, Jira and Bitbucket. The attacker viewed internal wiki pages and bug tickets and accessed some source code. Cloudflare disclosed on February 1, 2024 and rotated more than 5,000 production credentials in a Code Red remediation.", "identity_lesson": "After a third-party breach, every credential that party could have seen must be rotated, including service accounts thought to be unused. Rotation that misses a few is rotation that failed.", "sources": [ { "title": "Thanksgiving 2023 security incident", "publisher": "Cloudflare", "url": "https://blog.cloudflare.com/thanksgiving-2023-security-incident", "date": "2024-02-01" } ], "verified_on": "2026-10-31" }, { "id": "2024-microsoft-midnight-blizzard-password-spray", "name": "Midnight Blizzard password spray into Microsoft corporate email", "victim": "Microsoft", "industry": "technology", "country": "United States", "incident_date": "2023-11", "disclosed": "2024-01-19", "actor": "Midnight Blizzard (APT29)", "actor_type": "nation-state", "initial_access": "password-spraying", "identity_failure": "identity-lifecycle", "mfa": "absent", "non_human": false, "techniques": [ "password-spraying", "orphaned-account-abuse", "oauth-consent-phishing" ], "cves": [], "vendors": [ "iam/microsoft-entra" ], "teardown": "midnight-blizzard-2024-microsoft", "records_affected": null, "records_note": "Microsoft said a very small percentage of corporate email accounts, including senior leadership, security and legal staff, were accessed.", "financial_impact_usd": null, "financial_note": null, "regulatory": "CISA Emergency Directive 24-02 (April 2024) ordered federal agencies to analyze emails exfiltrated from Microsoft and reset credentials found in them.", "summary": "In late November 2023 Midnight Blizzard password-sprayed a legacy, non-production Microsoft test tenant account that had no MFA, then used a legacy test OAuth application with elevated access to the corporate tenant to create malicious apps and grant itself full access to Exchange Online mailboxes. Microsoft detected it on January 12, 2024 and disclosed in an 8-K on January 19. A March 2024 8-K/A said the actor had used secrets found in emails to reach some source code repositories and internal systems.", "identity_lesson": "MFA exceptions on forgotten test tenants and OAuth apps holding standing, tenant-wide privileges are both identity debt. Inventorying non-production identities and app permissions would have removed the path.", "sources": [ { "title": "Microsoft Form 8-K (Item 1.05)", "publisher": "US SEC", "url": "https://www.sec.gov/Archives/edgar/data/789019/000119312524011295/d708866d8k.htm", "date": "2024-01-19" }, { "title": "Microsoft Form 8-K/A (update)", "publisher": "US SEC", "url": "https://www.sec.gov/Archives/edgar/data/789019/000119312524062997/d808756d8ka.htm", "date": "2024-03-08" }, { "title": "Microsoft actions following attack by nation state actor Midnight Blizzard", "publisher": "Microsoft Security Response Center", "url": "https://www.microsoft.com/en-us/msrc/blog/2024/01/microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard", "date": "2024-01-19" }, { "title": "Midnight Blizzard: guidance for responders on nation-state attack", "publisher": "Microsoft Threat Intelligence", "url": "https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/", "date": "2024-01-25" }, { "title": "ED 24-02: Mitigating significant risk from nation-state compromise of Microsoft corporate email system", "publisher": "CISA", "url": "https://www.cisa.gov/news-events/directives/ed-24-02-mitigating-significant-risk-nation-state-compromise-microsoft-corporate-email-system-closed", "date": "2024-04-02" } ], "verified_on": "2026-10-31" }, { "id": "2023-comcast-xfinity-citrix-bleed", "name": "Comcast Xfinity customer data theft via Citrix Bleed", "victim": "Comcast (Xfinity)", "industry": "telecom", "country": "United States", "incident_date": "2023-10-16", "disclosed": "2023-12-18", "actor": null, "actor_type": "unknown", "initial_access": "identity-infra-vulnerability", "identity_failure": "session-and-tokens", "mfa": "bypassed", "non_human": false, "techniques": [ "token-replay-unbound-endpoint" ], "cves": [ "cve-2023-4966" ], "vendors": [], "teardown": null, "records_affected": 35879455, "records_note": "Customers, per Comcast's filing with the Maine attorney general (TechCrunch reported it as almost 35.8 million).", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "Between October 16 and October 19, 2023, before Comcast had finished mitigating, attackers exploited Citrix Bleed (CVE-2023-4966) in its NetScaler systems; Citrix had announced the flaw and a patch on October 10 and issued further mitigation guidance on October 23. On November 16 Comcast determined data was likely taken: usernames and hashed passwords, and for some customers names, contact details, last four digits of Social Security numbers, dates of birth and secret questions. Xfinity disclosed on December 18, 2023 and forced password resets.", "identity_lesson": "Citrix Bleed exposed session tokens, so the fix was patch plus terminating all existing sessions. Gaps of days between disclosure and patching, without session revocation, were enough for theft at scale.", "sources": [ { "title": "Notice to customers of data security incident", "publisher": "Xfinity", "url": "https://assets.xfinity.com/assets/dotcom/learn/Notice%20To%20Customers%20of%20Data%20Security%20Incident.pdf", "date": "2023-12-18" }, { "title": "Comcast says hackers stole data of close to 36 million Xfinity customers", "publisher": "TechCrunch", "url": "https://techcrunch.com/2023/12/19/comcast-xfinity-hackers-36-million-customers/", "date": "2023-12-19" } ], "verified_on": "2026-10-31" }, { "id": "2023-sumo-logic-aws-credential-compromise", "name": "Sumo Logic AWS account accessed with a compromised credential", "victim": "Sumo Logic", "industry": "b2b-saas", "country": "United States", "incident_date": "2023-11", "disclosed": "2023-11-07", "actor": null, "actor_type": "unknown", "initial_access": "stolen-credentials", "identity_failure": "credential-storage", "mfa": "unknown", "non_human": false, "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "Sumo Logic said it found no impact to customer data, which remained encrypted.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "On November 3, 2023 Sumo Logic found that a compromised credential had been used to access one of its AWS accounts. It locked down the infrastructure, rotated potentially exposed credentials and on November 7 told customers to rotate Sumo Logic API access keys and other credentials as a precaution, later narrowing the advice. The company did not say how the credential was obtained.", "identity_lesson": "Cloud account credentials need the same short lifetimes and anomaly monitoring as user logins; a single unrotated credential forced every customer to rotate their own keys.", "sources": [ { "title": "Security response center", "publisher": "Sumo Logic", "url": "https://www.sumologic.com/solutions/security/response-center", "date": "2023-11-20" }, { "title": "Sumo Logic discloses potential breach via compromised AWS credential", "publisher": "Help Net Security", "url": "https://www.helpnetsecurity.com/2023/11/08/sumo-logic-security-incident/", "date": "2023-11-08" } ], "verified_on": "2026-10-31" }, { "id": "2023-boeing-citrix-bleed-lockbit", "name": "Boeing Distribution breached by LockBit via Citrix Bleed session hijacking", "victim": "Boeing", "industry": "manufacturing", "country": "United States", "incident_date": "2023-10", "disclosed": "2023-11-01", "actor": "LockBit 3.0 affiliate", "actor_type": "extortion-group", "initial_access": "identity-infra-vulnerability", "identity_failure": "session-and-tokens", "mfa": "bypassed", "non_human": false, "techniques": [ "token-replay-unbound-endpoint", "session-cookie-theft" ], "cves": [ "cve-2023-4966" ], "vendors": [], "teardown": null, "records_affected": null, "records_note": null, "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "Boeing confirmed on November 1, 2023 a cyber incident affecting elements of its parts and distribution business, after LockBit appeared to claim credit. A joint CISA, FBI, MS-ISAC and ACSC advisory on November 21, 2023 stated Boeing observed LockBit 3.0 affiliates exploiting Citrix Bleed (CVE-2023-4966) to gain initial access to Boeing Distribution Inc. The flaw let attackers read valid NetScaler session tokens from memory and hijack authenticated sessions without a password or MFA.", "identity_lesson": "A session token copied from an appliance's memory is a full login. After patching, every NetScaler session had to be killed, because patching alone left already-stolen tokens valid.", "sources": [ { "title": "#StopRansomware: LockBit 3.0 ransomware affiliates exploit CVE 2023-4966 Citrix Bleed vulnerability (AA23-325A)", "publisher": "CISA", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a", "date": "2023-11-21" }, { "title": "Boeing admits cyberattack on parts and distribution biz", "publisher": "The Register", "url": "https://www.theregister.com/security/2023/11/02/boeing-admits-cyberattack-on-parts-and-distribution-biz/372826", "date": "2023-11-02" } ], "verified_on": "2026-10-31" }, { "id": "2023-okta-support-system-har-session-tokens", "name": "Okta customer support system breach and HAR-file session token theft", "victim": "Okta", "industry": "technology", "country": "United States", "incident_date": "2023-09-28", "disclosed": "2023-10-20", "actor": null, "actor_type": "unknown", "initial_access": "stolen-credentials", "identity_failure": "session-and-tokens", "mfa": "not-applicable", "non_human": true, "techniques": [ "session-cookie-theft" ], "cves": [], "vendors": [ "iam/okta" ], "teardown": "okta-2023-support-system-breach", "records_affected": 134, "records_note": "Customers whose support case files were accessed, per Okta. A report taken by the attacker listed names and email addresses of all customer support system users.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "From September 28 to October 17, 2023 an attacker used a service account credential, saved to an employee's personal Google profile on an Okta laptop, to access Okta's customer support case system. Files there included HAR files with live session tokens, which the attacker used to hijack sessions at five customers; 1Password, BeyondTrust and Cloudflare each detected and contained the activity. Okta disclosed on October 20, 2023 and on November 29 said the attacker had also downloaded names and emails of all support system users.", "identity_lesson": "Support uploads become credentials when they carry session tokens. Sanitizing HAR files, binding admin sessions to devices and keeping service account secrets out of personal browser profiles would each have broken the chain.", "sources": [ { "title": "Tracking unauthorized access to Okta's support system", "publisher": "Okta Security", "url": "https://sec.okta.com/articles/2023/10/tracking-unauthorized-access-oktas-support-system/", "date": "2023-10-20" }, { "title": "Unauthorized access to Okta's support case management system: root cause and remediation", "publisher": "Okta Security", "url": "https://sec.okta.com/articles/2023/11/unauthorized-access-oktas-support-case-management-system-root-cause/", "date": "2023-11-03" }, { "title": "How Cloudflare mitigated yet another Okta compromise", "publisher": "Cloudflare", "url": "https://blog.cloudflare.com/how-cloudflare-mitigated-yet-another-okta-compromise", "date": "2023-10-20" }, { "title": "Hackers stole access tokens from Okta's support unit", "publisher": "KrebsOnSecurity", "url": "https://krebsonsecurity.com/2023/10/hackers-stole-access-tokens-from-oktas-support-unit/", "date": "2023-10-20" } ], "verified_on": "2026-10-31" }, { "id": "2023-23andme-credential-stuffing-dna-relatives", "name": "23andMe credential stuffing and DNA Relatives data scraping", "victim": "23andMe", "industry": "healthcare", "country": "United States", "incident_date": "2023-04", "disclosed": "2023-10-06", "actor": null, "actor_type": "financially-motivated", "initial_access": "credential-stuffing", "identity_failure": "authentication", "mfa": "absent", "non_human": false, "techniques": [ "credential-stuffing" ], "cves": [], "vendors": [], "teardown": null, "records_affected": 6900000, "records_note": "About 6.9 million people whose profile data was exposed, per 23andMe; roughly 14,000 accounts (0.1 percent) were directly accessed. The ICO counted 155,592 UK residents.", "financial_impact_usd": null, "financial_note": null, "regulatory": "UK ICO fined 23andMe 2.31 million pounds on June 17, 2025, citing the lack of mandatory MFA and of extra verification before raw genetic data could be accessed or downloaded.", "summary": "Between April and September 2023 attackers logged into about 14,000 23andMe accounts with passwords reused from other breaches. Through the opt-in DNA Relatives feature, those accounts exposed profile data on about 6.9 million other users, including names, birth years, locations, relationship labels and ancestry. 23andMe disclosed on October 6, 2023 after data was offered for sale, and later required two-step verification for all users.", "identity_lesson": "A feature that lets one login see data about thousands of other people multiplies the cost of each stuffed account. Mandatory MFA, breached-password screening and rate limits on bulk relative views were the missing controls the ICO named.", "sources": [ { "title": "23andMe Form 8-K/A (cybersecurity incident update)", "publisher": "US SEC", "url": "https://www.sec.gov/Archives/edgar/data/1804591/000119312523287449/d242666d8ka.htm", "date": "2023-12-01" }, { "title": "Addressing data security concerns", "publisher": "23andMe", "url": "https://www.23andme.org/blog/articles/addressing-data-security-concerns/", "date": "2023-10-06" }, { "title": "23andMe fined for failing to protect UK users' genetic data", "publisher": "Information Commissioner's Office", "url": "https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/06/23andme-fined-for-failing-to-protect-uk-users-genetic-data/", "date": "2025-06-17" } ], "verified_on": "2026-10-31" }, { "id": "2023-microsoft-ai-research-sas-token-exposure", "name": "Microsoft AI research SAS token exposed 38 TB of internal data", "victim": "Microsoft", "industry": "technology", "country": "United States", "incident_date": "2020-07", "disclosed": "2023-09-18", "actor": "Wiz Research (discovered)", "actor_type": "researcher", "initial_access": "exposed-secrets", "identity_failure": "non-human-identity", "mfa": "not-applicable", "non_human": true, "techniques": [ "secrets-in-repositories-and-ci" ], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "38 TB of data, including workstation backups of two employees and more than 30,000 internal Teams messages, per Wiz. Microsoft said no customer data was exposed.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "A Microsoft AI research team published a GitHub repository with a link to open-source models that embedded an Azure Storage shared access signature (SAS) token. The token granted full control over an entire storage account, not just the models, and had been exposed since July 2020. Wiz reported it in June 2023, Microsoft revoked it, and both disclosed on September 18, 2023.", "identity_lesson": "A SAS token is a bearer credential with whatever scope and lifetime it was minted with. Scoping tokens to the specific container, setting short expiry and scanning public repos for signed URLs would have prevented the exposure.", "sources": [ { "title": "38TB of data accidentally exposed by Microsoft AI researchers", "publisher": "Wiz Research", "url": "https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers", "date": "2023-09-18" }, { "title": "Microsoft mitigated exposure of internal information in a storage account due to overly-permissive SAS token", "publisher": "Microsoft Security Response Center", "url": "https://www.microsoft.com/en-us/msrc/blog/2023/09/microsoft-mitigated-exposure-of-internal-information-in-a-storage-account-due-to-overly-permissive-sas-token", "date": "2023-09-18" } ], "verified_on": "2026-10-31" }, { "id": "2023-caesars-it-vendor-social-engineering", "name": "Caesars Entertainment loyalty database theft via IT support vendor", "victim": "Caesars Entertainment", "industry": "gaming", "country": "United States", "incident_date": "2023-08", "disclosed": "2023-09-14", "actor": "Scattered Spider (UNC3944)", "actor_type": "extortion-group", "initial_access": "help-desk-social-engineering", "identity_failure": "identity-lifecycle", "mfa": "unknown", "non_human": false, "techniques": [ "help-desk-social-engineering" ], "cves": [], "vendors": [], "teardown": "scattered-spider-helpdesk-social-engineering", "records_affected": null, "records_note": "Caesars said the loyalty database held driver's license or Social Security numbers for a significant number of members; it gave no count in the 8-K.", "financial_impact_usd": null, "financial_note": "Caesars did not disclose a ransom amount or incident cost.", "regulatory": null, "summary": "Caesars disclosed in a September 14, 2023 8-K that a social engineering attack on an outsourced IT support vendor gave an attacker access to its network, and that on September 7 it determined the loyalty program database had been taken. Caesars said it took steps to ensure the stolen data was deleted, wording TechTarget read as suggesting a ransom payment; Reuters and researchers reported Scattered Spider was behind the attack.", "identity_lesson": "An outsourced help desk holds the same reset power as an internal one and needs the same verification standard, logging and alerting on resets for privileged accounts.", "sources": [ { "title": "Caesars Entertainment Form 8-K (Item 8.01, cybersecurity incident)", "publisher": "US SEC", "url": "https://www.sec.gov/Archives/edgar/data/1590895/000119312523235015/d537840d8k.htm", "date": "2023-09-14" }, { "title": "Caesars Entertainment breached in social engineering attack", "publisher": "TechTarget", "url": "https://www.techtarget.com/news/Caesars-Entertainment-breached-in-social-engineering-attack/837596/", "date": "2023-09-14" } ], "verified_on": "2026-10-31" }, { "id": "2023-retool-sms-phishing-authenticator-sync", "name": "Retool SMS phishing, deepfaked call and Google Authenticator cloud sync", "victim": "Retool", "industry": "b2b-saas", "country": "United States", "incident_date": "2023-08-27", "disclosed": "2023-09-13", "actor": null, "actor_type": "financially-motivated", "initial_access": "phishing-credentials", "identity_failure": "authentication", "mfa": "bypassed", "non_human": false, "techniques": [ "otp-relay-social-engineering" ], "cves": [], "vendors": [ "mfa/google-authenticator" ], "teardown": null, "records_affected": 27, "records_note": "Cloud customer accounts taken over, per Retool.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "On August 27, 2023 attackers sent Retool employees SMS messages about a payroll issue linking to a fake login page; one employee entered credentials, then took a call from someone impersonating IT, using a deepfaked voice, and gave up an MFA code. Because Google Authenticator had synced the employee's MFA seeds to their Google account, compromising that account gave the attacker the employee's other factors as well. The attacker took over 27 cloud customer accounts, all in crypto.", "identity_lesson": "Cloud-synced OTP seeds turn one compromised account into every factor. Phishing-resistant MFA bound to a device, with no shareable secret, would have stopped both the code relay and the sync takeover.", "sources": [ { "title": "When MFA isn't actually MFA", "publisher": "Retool", "url": "https://retool.com/blog/mfa-isnt-mfa", "date": "2023-09-13" } ], "verified_on": "2026-10-31" }, { "id": "2023-mgm-resorts-help-desk-ransomware", "name": "MGM Resorts help desk social engineering and ransomware", "victim": "MGM Resorts International", "industry": "gaming", "country": "United States", "incident_date": "2023-09", "disclosed": "2023-09-11", "actor": "Scattered Spider (UNC3944), with ALPHV/BlackCat ransomware", "actor_type": "extortion-group", "initial_access": "help-desk-social-engineering", "identity_failure": "identity-lifecycle", "mfa": "bypassed", "non_human": false, "techniques": [ "help-desk-social-engineering" ], "cves": [], "vendors": [ "iam/okta" ], "teardown": "scattered-spider-helpdesk-social-engineering", "records_affected": null, "records_note": "MGM said customer personal data was taken but did not give a count in its 8-K.", "financial_impact_usd": 100000000, "financial_note": "Estimated negative impact of about $100 million to Adjusted Property EBITDAR for September 2023, plus under $10 million of one-time costs, per MGM's October 5, 2023 8-K.", "regulatory": "MGM agreed in January 2025 to a $45 million settlement of consolidated class actions covering this attack and a 2019 breach.", "summary": "MGM Resorts announced a cybersecurity issue on September 11, 2023 that took down hotel, casino and booking systems for days. Reporting and the attackers' own statements describe a call to MGM's IT help desk impersonating an employee found on LinkedIn, followed by control of MGM's Okta super administrator accounts and later ransomware on ESXi hosts. MGM's October 2023 8-K estimated a $100 million hit to Adjusted Property EBITDAR.", "identity_lesson": "A ten-minute phone call defeated the identity stack because the help desk could reset privileged credentials without strong verification. Hardened reset procedures and phishing-resistant MFA on IdP admins are the controls that matter.", "sources": [ { "title": "MGM Resorts Form 8-K (cybersecurity issue impact)", "publisher": "US SEC", "url": "https://www.sec.gov/Archives/edgar/data/789570/000119312523251667/d461062d8k.htm", "date": "2023-10-05" }, { "title": "MGM Resorts Form 8-K (September 2023)", "publisher": "US SEC", "url": "https://www.sec.gov/Archives/edgar/data/789570/000119312523233855/d502352d8k.htm", "date": "2023-09-13" }, { "title": "The MGM breach and the role of IdP in modern cyber attacks", "publisher": "Tenable", "url": "https://www.tenable.com/blog/the-mgm-breach-and-the-role-of-idp-in-modern-cyber-attacks", "date": "2023-09-20" }, { "title": "MGM agrees to $45 million payment to data breach, ransomware victims", "publisher": "The Record", "url": "https://therecord.media/mgm-agrees-45-million-payment-data-breach-ransomware-victims", "date": "2025-01-28" } ], "verified_on": "2026-10-31" }, { "id": "2023-okta-customer-help-desk-super-admin-takeover", "name": "Help desk resets of Okta super administrator MFA at multiple customers", "victim": "Multiple: Okta customers (Okta said four were compromised)", "industry": "cross-industry", "country": "United States", "incident_date": null, "disclosed": "2023-08-31", "actor": null, "actor_type": "financially-motivated", "initial_access": "help-desk-social-engineering", "identity_failure": "identity-lifecycle", "mfa": "bypassed", "non_human": false, "techniques": [ "help-desk-social-engineering" ], "cves": [], "vendors": [ "iam/okta" ], "teardown": "scattered-spider-helpdesk-social-engineering", "records_affected": null, "records_note": null, "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "Okta warned on August 31, 2023 that attackers were calling customers' IT service desks and persuading staff to reset all MFA factors on highly privileged Okta accounts. With super administrator access, they impersonated users, changed authentication policies and added a second identity provider through inbound federation so they could sign in as anyone. The warning came days before MGM Resorts and Caesars Entertainment disclosed their own intrusions.", "identity_lesson": "Factor resets for privileged accounts need verification an attacker cannot talk their way through (visual or in-person checks, manager approval), and super administrator roles should be few, phishing-resistant and alerting on any change to identity providers.", "sources": [ { "title": "Cross-tenant impersonation: prevention and detection", "publisher": "Okta Security", "url": "https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection/", "date": "2023-08-31" }, { "title": "Okta: 4 customers compromised in social engineering attacks", "publisher": "TechTarget", "url": "https://www.techtarget.com/news/Okta-4-customers-compromised-in-social-engineering-attacks/837604/", "date": "2023-09-01" } ], "verified_on": "2026-10-31" }, { "id": "2023-clorox-help-desk-password-reset", "name": "Clorox intrusion after outsourced help desk reset passwords and MFA", "victim": "The Clorox Company", "industry": "manufacturing", "country": "United States", "incident_date": "2023-08", "disclosed": "2023-08-14", "actor": "Scattered Spider", "actor_type": "extortion-group", "initial_access": "help-desk-social-engineering", "identity_failure": "identity-lifecycle", "mfa": "bypassed", "non_human": false, "techniques": [ "help-desk-social-engineering" ], "cves": [], "vendors": [], "teardown": "scattered-spider-helpdesk-social-engineering", "records_affected": null, "records_note": null, "financial_impact_usd": null, "financial_note": "Damages Clorox claims in its July 2025 lawsuit against Cognizant (lost sales plus remediation). This is a claimed figure, not an audited cost; Clorox's FY2024 10-K reported about $29 million of incremental costs net of $30 million in insurance recoveries.", "regulatory": "Clorox sued its help desk provider Cognizant in California state court in July 2025, seeking about $380 million; Cognizant disputes the claims.", "summary": "Clorox disclosed in an August 14, 2023 8-K that an attack had damaged parts of its IT infrastructure, causing widescale disruption and product shortages. In its July 2025 lawsuit, Clorox alleges an attacker posing as an employee called the Cognizant-run service desk and was given password and MFA resets without identity verification, citing call transcripts. Press coverage of the suit tied the attack to Scattered Spider.", "identity_lesson": "The reset path is part of authentication. Requiring verified identity before any password or MFA reset, plus notifying the employee and manager on every reset, closes the route Clorox describes.", "sources": [ { "title": "Clorox Form 8-K (cybersecurity incident)", "publisher": "US SEC", "url": "https://www.sec.gov/Archives/edgar/data/21076/000120677423000969/clx4231381-8k.htm", "date": "2023-08-14" }, { "title": "Clorox Form 10-K for fiscal 2024", "publisher": "US SEC", "url": "https://www.sec.gov/Archives/edgar/data/21076/000002107624000030/clx-20240630_d2.htm", "date": "2024-08-13" }, { "title": "Lawsuit says Clorox hackers got passwords simply by asking (Reuters)", "publisher": "Insurance Journal", "url": "https://www.insurancejournal.com/news/national/2025/07/22/832824.htm", "date": "2025-07-22" } ], "verified_on": "2026-10-31" }, { "id": "2023-storm-0558-microsoft-signing-key-forgery", "name": "Storm-0558 forged Microsoft tokens to read Exchange Online mail", "victim": "Microsoft and about 25 customer organizations, including US government agencies", "industry": "technology", "country": "United States", "incident_date": "2023-05-15", "disclosed": "2023-07-11", "actor": "Storm-0558", "actor_type": "nation-state", "initial_access": "identity-infra-vulnerability", "identity_failure": "directory-and-trust", "mfa": "not-applicable", "non_human": false, "techniques": [], "cves": [], "vendors": [ "iam/microsoft-entra" ], "teardown": null, "records_affected": null, "records_note": "Microsoft said about 25 organizations were affected; it did not publish a mailbox count.", "financial_impact_usd": null, "financial_note": null, "regulatory": "Cyber Safety Review Board review, released April 2024, concluded the intrusion was preventable and resulted from a cascade of Microsoft security failures.", "summary": "A China-based actor Microsoft tracks as Storm-0558 used an acquired Microsoft consumer (MSA) signing key to forge authentication tokens, and a token validation flaw let those consumer-signed tokens be accepted for enterprise Exchange Online and Outlook.com mailboxes. Access began around May 15, 2023 and was detected by the US State Department through its audit logs in June. Microsoft disclosed on July 11, 2023; the CSRB review found Microsoft never established how the key was stolen.", "identity_lesson": "A single signing key is the root of trust for every token it signs. Hardware-protected keys with enforced rotation, strict issuer and audience validation, and audit logs available to every customer were the controls the CSRB found missing.", "sources": [ { "title": "Analysis of Storm-0558 techniques for unauthorized email access", "publisher": "Microsoft Threat Intelligence", "url": "https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/", "date": "2023-07-14" }, { "title": "Results of major technical investigations for Storm-0558 key acquisition", "publisher": "Microsoft Security Response Center", "url": "https://www.microsoft.com/en-us/msrc/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition", "date": "2023-09-06" }, { "title": "CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion", "publisher": "CISA / Cyber Safety Review Board", "url": "https://www.cisa.gov/resources-tools/resources/CSRB-Review-Summer-2023-MEO-Intrusion", "date": "2024-04-02" } ], "verified_on": "2026-10-31" }, { "id": "2023-chick-fil-a-credential-stuffing", "name": "Chick-fil-A One account credential stuffing", "victim": "Chick-fil-A", "industry": "retail-ecommerce", "country": "United States", "incident_date": "2022-12-18", "disclosed": "2023-03-02", "actor": null, "actor_type": "financially-motivated", "initial_access": "credential-stuffing", "identity_failure": "authentication", "mfa": "absent", "non_human": false, "techniques": [ "credential-stuffing" ], "cves": [], "vendors": [], "teardown": null, "records_affected": 71473, "records_note": "Customers, per Chick-fil-A's filing with the Maine attorney general.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "From December 18, 2022 to February 12, 2023, attackers tested credentials stolen in other breaches against Chick-fil-A One loyalty accounts and took over 71,473 of them, exposing names, contact details, partial card numbers and reward balances. Chick-fil-A notified customers in a letter dated March 2, 2023, forced logouts, removed stored payment methods and restored balances.", "identity_lesson": "Loyalty accounts with stored value are a cash-out target. Breached-password checks, bot detection and step-up authentication before redeeming value would have blunted a months-long stuffing run.", "sources": [ { "title": "Over 71K impacted by credential stuffing attacks on Chick-fil-A accounts", "publisher": "SecurityWeek", "url": "https://www.securityweek.com/over-71k-impacted-by-credential-stuffing-attacks-on-chick-fil-a-accounts/", "date": "2023-03-06" }, { "title": "Credential stuffing attack at Chick-fil-A comes with data breach notice for customers", "publisher": "Bitdefender", "url": "https://www.bitdefender.com/en-us/blog/hotforsecurity/chick-fil-a-credential-stuffing-data-breach-account-takeover", "date": "2023-03-07" } ], "verified_on": "2026-10-31" }, { "id": "2023-reddit-employee-phishing", "name": "Reddit employee phished via cloned intranet gateway", "victim": "Reddit", "industry": "media-streaming", "country": "United States", "incident_date": "2023-02-05", "disclosed": "2023-02-09", "actor": null, "actor_type": "unknown", "initial_access": "phishing-credentials", "identity_failure": "authentication", "mfa": "bypassed", "non_human": false, "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "Reddit said limited contact information for some current and former employees and advertisers was accessed.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "On February 5, 2023 attackers sent Reddit employees prompts pointing to a site that cloned Reddit's intranet gateway, built to capture both passwords and second-factor codes. One employee entered credentials and a code, and the attacker reached internal documents, code, dashboards and business systems before the employee self-reported. Reddit disclosed on February 9, 2023.", "identity_lesson": "One-time codes can be phished along with the password. Phishing-resistant MFA (FIDO2 or passkeys bound to the real domain) would have failed on the cloned site.", "sources": [ { "title": "We had a security incident. Here's what we know.", "publisher": "Reddit (r/reddit)", "url": "https://www.reddit.com/r/reddit/comments/10y427y/we_had_a_security_incident_heres_what_we_know/", "date": "2023-02-09" } ], "verified_on": "2026-10-31" }, { "id": "2023-github-machine-account-token-code-signing", "name": "GitHub repositories cloned with a compromised machine-account token", "victim": "GitHub", "industry": "technology", "country": "United States", "incident_date": "2022-12-06", "disclosed": "2023-01-30", "actor": null, "actor_type": "unknown", "initial_access": "stolen-credentials", "identity_failure": "non-human-identity", "mfa": "not-applicable", "non_human": true, "techniques": [ "static-api-key-abuse" ], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": null, "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "On December 6, 2022 an attacker used a compromised personal access token belonging to a GitHub machine account to clone repositories from GitHub's atom, desktop and other deprecated organizations. The repositories held encrypted code-signing certificates for GitHub Desktop and Atom. GitHub revoked the token on December 7, disclosed on January 30, 2023, and revoked the exposed certificates on February 2, 2023, which disabled some older Desktop for Mac and Atom builds.", "identity_lesson": "A long-lived token on a machine account, with read access to repositories that held signing material, was enough. Short-lived, narrowly scoped workload credentials and keeping signing keys out of source control would have removed the payoff.", "sources": [ { "title": "GitHub revokes stolen code signing certs, invalidates some versions of Atom and GitHub Desktop for Mac", "publisher": "DevClass", "url": "https://www.devclass.com/devops/2023/01/31/github-revokes-stolen-code-signing-certs-invalidates-some-versions-of-atom-and-github-desktop-for-mac/1626490", "date": "2023-01-31" } ], "verified_on": "2026-10-31" }, { "id": "2023-paypal-credential-stuffing", "name": "PayPal account credential stuffing exposing tax data", "victim": "PayPal", "industry": "financial-services", "country": "United States", "incident_date": "2022-12-06", "disclosed": "2023-01-18", "actor": null, "actor_type": "financially-motivated", "initial_access": "credential-stuffing", "identity_failure": "authentication", "mfa": "absent", "non_human": false, "techniques": [ "credential-stuffing" ], "cves": [], "vendors": [], "teardown": null, "records_affected": 34942, "records_note": "Account holders notified, per PayPal's filing with the Maine attorney general.", "financial_impact_usd": 2000000, "financial_note": "Civil penalty paid to the New York Department of Financial Services (consent order, January 23, 2025).", "regulatory": "New York DFS consent order and $2 million penalty, January 23, 2025, finding PayPal failed to require MFA or use controls such as CAPTCHA and rate limiting, after attackers used compromised credentials to reach unmasked Social Security numbers on 1099-K forms.", "summary": "Between December 6 and December 8, 2022, attackers logged into 34,942 PayPal accounts using username and password pairs reused from other breaches, exposing names, addresses, dates of birth and Social Security or tax ID numbers. PayPal notified affected users on January 18, 2023. New York DFS later found that a data flow change had made full Social Security numbers visible and that PayPal had not required MFA.", "identity_lesson": "Customer accounts that expose tax identifiers need MFA and credential stuffing defenses by default; DFS named both as missing controls.", "sources": [ { "title": "Superintendent Harris announces $2 million penalty against PayPal for cybersecurity failures", "publisher": "New York State Department of Financial Services", "url": "https://www.dfs.ny.gov/reports_and_publications/press_releases/pr20250123", "date": "2025-01-23" }, { "title": "PayPal warns 35,000 users of credential stuffing attacks", "publisher": "SecurityWeek", "url": "https://www.securityweek.com/paypal-warns-35000-users-credential-stuffing-attacks/", "date": "2023-01-19" }, { "title": "PayPal says crooks accessed 34,942 customers' info", "publisher": "The Register", "url": "https://www.theregister.com/security/2023/01/19/paypal-says-crooks-accessed-34942-customers-info/716362", "date": "2023-01-19" } ], "verified_on": "2026-10-31" }, { "id": "2023-norton-lifelock-credential-stuffing", "name": "Norton LifeLock account credential stuffing with Password Manager exposure", "victim": "Gen Digital (Norton LifeLock)", "industry": "technology", "country": "United States", "incident_date": "2022-12-01", "disclosed": "2023-01-16", "actor": null, "actor_type": "financially-motivated", "initial_access": "credential-stuffing", "identity_failure": "authentication", "mfa": "absent", "non_human": false, "techniques": [ "credential-stuffing" ], "cves": [], "vendors": [], "teardown": null, "records_affected": 6453, "records_note": "Individuals, per Gen Digital's notice to the Maine attorney general. Some reports round to about 6,450.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "Gen Digital detected a high volume of failed logins to Norton accounts on December 12, 2022 and found a credential stuffing attack that began around December 1. It notified about 6,450 customers in January 2023 and said it could not rule out that attackers also read vaults in Norton Password Manager, especially where the vault key matched the account password.", "identity_lesson": "Breached-password screening, bot defenses and mandatory MFA on the account that guards a password vault would have stopped reused passwords from opening it.", "sources": [ { "title": "Norton Password Manager accounts at risk after attack", "publisher": "BankInfoSecurity", "url": "https://www.bankinfosecurity.com/norton-password-manager-accounts-at-risk-after-attack-a-20943", "date": "2023-01-16" }, { "title": "NortonLifeLock warns customers about potential Password Manager breach", "publisher": "HIPAA Journal", "url": "https://www.hipaajournal.com/nortonlifelock-warns-customers-about-potential-password-manager-breach/", "date": "2023-01-17" } ], "verified_on": "2026-10-31" }, { "id": "2023-mailchimp-employee-social-engineering", "name": "Mailchimp internal support tool access via employee social engineering", "victim": "Mailchimp (Intuit)", "industry": "b2b-saas", "country": "United States", "incident_date": "2023-01", "disclosed": "2023-01-13", "actor": null, "actor_type": "unknown", "initial_access": "phishing-credentials", "identity_failure": "authentication", "mfa": "unknown", "non_human": false, "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": 133, "records_note": "Mailchimp customer accounts accessed, per Mailchimp.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "On January 11, 2023 Mailchimp found an attacker inside an internal tool its customer-facing teams use for support and account administration. The attacker had run a social engineering campaign against Mailchimp employees and contractors and used the credentials it collected to log in, then viewed 133 customer accounts. It was Mailchimp's second support-tool compromise in under six months.", "identity_lesson": "Internal support and admin consoles that can see into any customer account need phishing-resistant authentication and tight per-session access, because a phished employee login becomes access to every customer.", "sources": [ { "title": "January 2023 security incident", "publisher": "Mailchimp", "url": "https://mailchimp.com/newsroom/january-2023-security-incident/", "date": "2023-01-13" } ], "verified_on": "2026-10-31" }, { "id": "2023-circleci-engineer-session-token-theft", "name": "CircleCI engineer session token theft and customer secrets exposure", "victim": "CircleCI", "industry": "b2b-saas", "country": "United States", "incident_date": "2022-12-16", "disclosed": "2023-01-04", "actor": null, "actor_type": "unknown", "initial_access": "session-token-theft", "identity_failure": "session-and-tokens", "mfa": "bypassed", "non_human": false, "techniques": [ "session-cookie-theft" ], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "CircleCI did not publish a count of affected customers; it told all customers to rotate every secret stored in the platform.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "Malware on a CircleCI engineer's laptop, undetected by antivirus, stole a valid SSO session cookie that was already backed by 2FA. Using that session, the attacker reached production systems between December 19 and December 22, 2022, and exfiltrated customer environment variables, tokens and keys, along with the encryption keys needed to read them. CircleCI disclosed on January 4, 2023 and told every customer to rotate all secrets.", "identity_lesson": "MFA protected the login, not the session that followed it. Short-lived, device-bound sessions for production access and treating stored customer secrets as tier-zero would have limited what one stolen cookie could reach.", "sources": [ { "title": "CircleCI incident report for January 4, 2023 security incident", "publisher": "CircleCI", "url": "https://circleci.com/blog/jan-4-2023-incident-report/", "date": "2023-01-13" }, { "title": "Security alert: January 4, 2023", "publisher": "CircleCI", "url": "https://circleci.com/blog/january-4-2023-security-alert/", "date": "2023-01-04" } ], "verified_on": "2026-10-31" }, { "id": "2022-slack-github-stolen-tokens", "name": "Slack private GitHub repositories downloaded with stolen employee tokens", "victim": "Slack (Salesforce)", "industry": "b2b-saas", "country": "United States", "incident_date": "2022-12-27", "disclosed": "2022-12-31", "actor": null, "actor_type": "unknown", "initial_access": "session-token-theft", "identity_failure": "session-and-tokens", "mfa": "not-applicable", "non_human": false, "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "Private code repositories only; Slack said no customer data or primary codebase was accessed.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "On December 27, 2022 an attacker used a limited number of stolen Slack employee tokens to access Slack's externally hosted GitHub repositories and download private code. Slack was notified of suspicious activity on December 29 and posted a security update on December 31, 2022; a January 2023 update said the tokens came from a compromised third-party vendor.", "identity_lesson": "Long-lived developer tokens stored at third-party vendors are reusable credentials; short token lifetimes and IP or device binding make stolen tokens expire before they are used.", "sources": [ { "title": "Slack Security Update", "publisher": "Slack", "url": "https://slack.com/blog/news/slack-security-update", "date": "2022-12-31" }, { "title": "Slack's private GitHub code repositories stolen over holidays", "publisher": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/slacks-private-github-code-repositories-stolen-over-holidays/", "date": "2023-01-04" } ], "verified_on": "2026-10-31" }, { "id": "2022-dropbox-github-phishing", "name": "Dropbox GitHub repositories stolen via CircleCI-themed phishing", "victim": "Dropbox", "industry": "technology", "country": "United States", "incident_date": "2022-10", "disclosed": "2022-11-01", "actor": null, "actor_type": "unknown", "initial_access": "phishing-aitm", "identity_failure": "authentication", "mfa": "bypassed", "non_human": false, "techniques": [ "aitm-phishing-proxy" ], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "130 code repositories copied; Dropbox said no user account content, passwords or payment data were accessed.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "In early October 2022 Dropbox employees received phishing emails impersonating CircleCI that led to a fake login page, where staff entered GitHub credentials and passed one-time passwords from their hardware keys to the site. The attacker used this access to copy 130 code repositories from one of Dropbox's GitHub organizations; GitHub alerted Dropbox on October 14 and Dropbox disclosed on November 1, 2022.", "identity_lesson": "OTP from a hardware token is still phishable; WebAuthn security keys bind the login to the real origin, and Dropbox moved its environment to them.", "sources": [ { "title": "How we handled a recent phishing incident that targeted Dropbox", "publisher": "Dropbox", "url": "https://dropbox.tech/security/a-recent-phishing-campaign-targeting-dropbox", "date": "2022-11-01" } ], "verified_on": "2026-10-31" }, { "id": "2022-medibank-contractor-credentials-vpn", "name": "Medibank breach via contractor credentials on VPN without MFA", "victim": "Medibank Private", "industry": "insurance", "country": "Australia", "incident_date": "2022-08", "disclosed": "2022-10-13", "actor": "Aleksandr Ermakov (REvil-linked, sanctioned)", "actor_type": "extortion-group", "initial_access": "stolen-credentials", "identity_failure": "authentication", "mfa": "absent", "non_human": false, "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": 9700000, "records_note": "About 9.7 million current and former customers and representatives, per the OAIC and U.S. Treasury.", "financial_impact_usd": null, "financial_note": "Medibank reported non-recurring cybercrime costs of A$46.4 million in FY23 and A$39.8 million in FY24 (AUD, not converted), per iTnews.", "regulatory": "July 1, 2023: APRA applied a A$250 million capital adequacy adjustment. January 2024: Australia, the U.S. and the UK sanctioned Aleksandr Ermakov for the attack. June 5, 2024: the OAIC began civil penalty proceedings in the Federal Court.", "summary": "An IT service desk operator at a Medibank contractor had saved his Medibank usernames and passwords in a browser profile on his personal computer; the OAIC alleges an attacker used those credentials to log into Medibank's GlobalProtect VPN, which did not require MFA. The attacker exfiltrated data on about 9.7 million people and later published it on the dark web. Medibank disclosed a cyber incident on October 13, 2022.", "identity_lesson": "MFA on every VPN login, and a ban on syncing privileged credentials into personal browsers, would have made the stolen password useless.", "sources": [ { "title": "AIC v Medibank Private Limited: concise statement", "publisher": "Office of the Australian Information Commissioner", "url": "https://www.oaic.gov.au/__data/assets/pdf_file/0025/221974/AIC-v-Medibank-Private-Limited-concise-statement.pdf", "date": "2024-06-05" }, { "title": "OAIC takes civil penalty action against Medibank", "publisher": "Office of the Australian Information Commissioner", "url": "https://www.oaic.gov.au/news/media-centre/oaic-takes-civil-penalty-action-against-medibank", "date": "2024-06-05" }, { "title": "United States, Australia, and the United Kingdom Sanction Russian Cyber Actor Responsible for the Medibank Hack", "publisher": "U.S. Department of the Treasury", "url": "https://home.treasury.gov/news/press-releases/jy2041", "date": "2024-01-23" }, { "title": "Medibank's data breach costs anticipated to reach $126m by mid-2025", "publisher": "iTnews", "url": "https://www.itnews.com.au/news/medibanks-data-breach-costs-anticipated-to-reach-126m-by-mid-2025-610905", "date": "2024-08-22" } ], "verified_on": "2026-10-31" }, { "id": "2022-optus-unauthenticated-api", "name": "Optus customer data breach via API with broken access controls", "victim": "Optus (Singtel Optus)", "industry": "telecom", "country": "Australia", "incident_date": "2022-09-17", "disclosed": "2022-09-22", "actor": null, "actor_type": "unknown", "initial_access": "misconfiguration", "identity_failure": "authorization", "mfa": "not-applicable", "non_human": false, "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": 9500000, "records_note": "About 9.5 million current, former and prospective customers, per the OAIC; Optus first reported up to 9.8 million records.", "financial_impact_usd": null, "financial_note": null, "regulatory": "May 2024: ACMA filed Federal Court proceedings alleging Optus failed to protect customer information under the Telecommunications Act. August 8, 2025: the OAIC announced civil penalty proceedings alleging one Privacy Act contravention per affected individual, with up to A$2.22 million per contravention.", "summary": "Between September 17 and 20, 2022 an attacker sent requests to an internet-facing Optus API that returned customer personal information without valid authorization. ACMA alleges a 2018 coding error in the API's access controls left it open, and that Optus fixed the same error on its main domain in 2021 but not on the dormant API domain. Optus disclosed the breach on September 22, 2022.", "identity_lesson": "Every API that returns personal data must enforce authentication and object-level authorization, with dormant endpoints removed and access control tests in the release pipeline.", "sources": [ { "title": "Optus notifies customers of cyberattack", "publisher": "Optus", "url": "https://www.optus.com.au/about/media-centre/media-releases/2022/09/optus-notifies-customers-of-cyberattack", "date": "2022-09-22" }, { "title": "Australian Information Commissioner takes civil penalty action against Optus", "publisher": "Office of the Australian Information Commissioner", "url": "https://www.oaic.gov.au/news/media-centre/australian-information-commissioner-takes-civil-penalty-action-against-optus", "date": "2025-08-08" }, { "title": "Optus breach allegedly enabled by access control coding error", "publisher": "iTnews", "url": "https://www.itnews.com.au/news/optus-breach-allegedly-enabled-by-access-control-coding-error-608985", "date": "2024-06-20" } ], "verified_on": "2026-10-31" }, { "id": "2022-uber-mfa-fatigue", "name": "Uber breach via contractor password and MFA fatigue", "victim": "Uber", "industry": "technology", "country": "United States", "incident_date": "2022-09-15", "disclosed": "2022-09-15", "actor": "LAPSUS$ (affiliated, per Uber)", "actor_type": "extortion-group", "initial_access": "mfa-fatigue", "identity_failure": "authentication", "mfa": "bypassed", "non_human": false, "techniques": [ "mfa-fatigue-push-bombing", "infostealer-credential-harvesting" ], "cves": [], "vendors": [], "teardown": "mfa-fatigue-push-bombing", "records_affected": null, "records_note": null, "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "On September 15, 2022 an attacker logged in with an Uber contractor's corporate password, likely bought on the dark web after malware infected the contractor's personal device. Repeated login attempts sent the contractor multiple two-factor approval requests until one was accepted. The attacker then reached other employee accounts and gained elevated permissions to tools including G-Suite and Slack, and accessed Uber's HackerOne dashboard.", "identity_lesson": "Number matching or phishing-resistant MFA ends push fatigue, and rate limits on push prompts plus alerts on repeated denials catch it in progress.", "sources": [ { "title": "Security update", "publisher": "Uber", "url": "https://www.uber.com/us/en/newsroom/security-update/", "date": "2022-09-19" }, { "title": "The Uber Hack's Devastation Is Just Starting to Reveal Itself", "publisher": "WIRED", "url": "https://www.wired.com/story/uber-hack-mfa-phishing/", "date": "2022-09-16" } ], "verified_on": "2026-10-31" }, { "id": "2022-0ktapus-phishing-campaign", "name": "0ktapus SMS phishing campaign against Okta users", "victim": "Multiple: more than 130 organizations", "industry": "cross-industry", "country": "Global", "incident_date": "2022-03", "disclosed": "2022-08-25", "actor": "0ktapus (Scatter Swine), later linked to Scattered Spider", "actor_type": "financially-motivated", "initial_access": "phishing-credentials", "identity_failure": "authentication", "mfa": "bypassed", "non_human": false, "techniques": [ "otp-relay-social-engineering" ], "cves": [], "vendors": [ "iam/okta" ], "teardown": null, "records_affected": 9931, "records_note": "9,931 credential sets and 5,441 MFA codes captured, per Group-IB.", "financial_impact_usd": null, "financial_note": null, "regulatory": "November 2024: U.S. prosecutors charged five men alleged to be members of the Scattered Spider and 0ktapus group.", "summary": "Group-IB reported on August 25, 2022 that a campaign running since at least March 2022 sent SMS messages linking to fake Okta login pages, capturing 9,931 credential sets and 5,441 MFA codes from users at more than 130 organizations through 169 phishing domains. Victims included Twilio, Mailchimp and DoorDash; Okta tracked the actor as Scatter Swine and saw it use Twilio console access to read one-time passcodes.", "identity_lesson": "Phishing kits that relay passwords and one-time codes in real time defeat SMS and TOTP MFA; only origin-bound authenticators such as FIDO2 security keys resist them.", "sources": [ { "title": "Roasting 0ktapus: The phishing campaign going after Okta identity credentials", "publisher": "Group-IB", "url": "https://www.group-ib.com/blog/0ktapus/", "date": "2022-08-25" }, { "title": "Detecting Scatter Swine: Insights into a Relentless Phishing Campaign", "publisher": "Okta", "url": "https://sec.okta.com/scatterswine", "date": "2022-08-25" }, { "title": "Feds Charge Five Men in 'Scattered Spider' Roundup", "publisher": "KrebsOnSecurity", "url": "https://krebsonsecurity.com/2024/11/feds-charge-five-men-in-scattered-spider-roundup/", "date": "2024-11-21" } ], "verified_on": "2026-10-31" }, { "id": "2022-doordash-vendor-phishing", "name": "DoorDash data access via phished third-party vendor credentials", "victim": "DoorDash", "industry": "retail-ecommerce", "country": "United States", "incident_date": "2022-08", "disclosed": "2022-08-25", "actor": "0ktapus (linked by DoorDash to the Twilio campaign)", "actor_type": "financially-motivated", "initial_access": "third-party-access", "identity_failure": "authorization", "mfa": "unknown", "non_human": false, "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "DoorDash did not give a count; exposed data included customer names, emails, delivery addresses and phone numbers, and partial card data for a smaller group.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "DoorDash disclosed on August 25, 2022 that attackers used credentials stolen from employees of a third-party vendor in a phishing attack to reach some DoorDash internal tools. Customer and driver contact data was exposed. DoorDash tied the incident to the same campaign that hit Twilio, and disabled the vendor's access.", "identity_lesson": "Vendor accounts into internal tools need the same phishing-resistant MFA and least-privilege scoping as employee accounts.", "sources": [ { "title": "Twilio hackers also breached the food delivery firm DoorDash", "publisher": "Security Affairs", "url": "https://securityaffairs.com/134905/data-breach/twilio-hackers-breached-doordash.html", "date": "2022-08-26" }, { "title": "DoorDash says data breach at third-party vendor exposes personal data of customers and employees", "publisher": "Bitdefender", "url": "https://www.bitdefender.com/en-us/blog/hotforsecurity/doordash-says-data-breach-at-third-party-vendor-exposes-personal-data-of-customers-and-employees", "date": "2022-08-26" } ], "verified_on": "2026-10-31" }, { "id": "2022-lastpass-vault-backup-theft", "name": "LastPass customer vault backup theft via engineer credentials and trusted device cookie", "victim": "LastPass", "industry": "technology", "country": "United States", "incident_date": "2022-08", "disclosed": "2022-08-25", "actor": null, "actor_type": "unknown", "initial_access": "stolen-credentials", "identity_failure": "credential-storage", "mfa": "bypassed", "non_human": false, "techniques": [ "session-cookie-theft", "static-api-key-abuse" ], "cves": [], "vendors": [ "password-management/lastpass" ], "teardown": null, "records_affected": null, "records_note": "Global count not disclosed; the ICO said up to 1.6 million UK users were affected.", "financial_impact_usd": null, "financial_note": "ICO fine of GBP 1.2 million (not converted).", "regulatory": "December 11, 2025: the UK ICO fined LastPass UK Ltd GBP 1.2 million under UK GDPR Articles 5(1)(f) and 32.", "summary": "In August 2022 an attacker compromised a LastPass employee's corporate laptop and took source code and encrypted credentials from the development environment, which LastPass disclosed on August 25, 2022. The attacker then targeted a senior engineer with access to decryption keys, used a vulnerability in third-party media software on his home computer to install a keylogger, captured his master password and bypassed MFA with a trusted device cookie. The AWS access key and decryption key in his vault let the attacker copy customer vault backups, disclosed in December 2022.", "identity_lesson": "Keys that decrypt all customer backups should not sit in one person's password vault on a personal device; hardware-bound MFA and split custody of production keys would have broken the chain.", "sources": [ { "title": "Password manager provider fined", "publisher": "Information Commissioner's Office", "url": "https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/12/password-manager-provider-fined", "date": "2025-12-11" }, { "title": "LastPass hammered with £1.2M fine for 2022 breach fiasco", "publisher": "The Register", "url": "https://www.theregister.com/2025/12/11/lastpass_ico_fine/", "date": "2025-12-11" } ], "verified_on": "2026-10-31" }, { "id": "2022-signal-twilio-registration", "name": "Signal account re-registration via Twilio support console", "victim": "Signal", "industry": "technology", "country": "United States", "incident_date": "2022-08", "disclosed": "2022-08-15", "actor": "0ktapus (via Twilio compromise)", "actor_type": "financially-motivated", "initial_access": "third-party-access", "identity_failure": "authentication", "mfa": "unknown", "non_human": false, "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": 1900, "records_note": "About 1,900 users whose phone numbers or SMS verification codes may have been exposed, per Signal; one account was re-registered.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "Signal said on August 15, 2022 that the attacker who phished Twilio, its phone number verification provider, could see for about 1,900 users either that their number was registered to Signal or the SMS registration code. The attacker searched explicitly for three numbers, and one of those users reported that their account was re-registered to the attacker.", "identity_lesson": "SMS codes are only as safe as the telecom chain that delivers them; a PIN-based registration lock stops a stolen code from taking over the account.", "sources": [ { "title": "1,900 Signal users exposed following Twilio breach", "publisher": "Help Net Security", "url": "https://www.helpnetsecurity.com/2022/08/16/signal-twilio-breach/", "date": "2022-08-16" } ], "verified_on": "2026-10-31" }, { "id": "2022-mailchimp-internal-tool-august", "name": "Mailchimp August 2022 support tool breach via phished credentials", "victim": "Mailchimp (Intuit)", "industry": "b2b-saas", "country": "United States", "incident_date": "2022-08", "disclosed": "2022-08-12", "actor": null, "actor_type": "financially-motivated", "initial_access": "phishing-credentials", "identity_failure": "authentication", "mfa": "unknown", "non_human": false, "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": 214, "records_note": "214 Mailchimp accounts, per Mailchimp.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "Mailchimp's security team became aware on August 8, 2022 that an actor had used a social engineering attack on employees and their compromised credentials to access an internal customer support and account administration tool, targeting users in crypto and finance. Mailchimp said 214 accounts were affected; it was the second such incident in five months.", "identity_lesson": "A repeat of the same path months later shows the fix has to be structural: phishing-resistant authenticators for every user of privileged support tools.", "sources": [ { "title": "Information About a Recent Security Incident Targeting Crypto Companies", "publisher": "Mailchimp", "url": "https://mailchimp.com/newsroom/august-2022-security-incident/", "date": "2022-08-12" } ], "verified_on": "2026-10-31" }, { "id": "2022-cisco-vishing-mfa-fatigue", "name": "Cisco corporate network breach via synced credentials, vishing and MFA fatigue", "victim": "Cisco", "industry": "technology", "country": "United States", "incident_date": "2022-05-24", "disclosed": "2022-08-10", "actor": "Initial access broker linked to UNC2447, LAPSUS$ and Yanluowang (per Cisco Talos)", "actor_type": "extortion-group", "initial_access": "mfa-fatigue", "identity_failure": "authentication", "mfa": "bypassed", "non_human": false, "techniques": [ "mfa-fatigue-push-bombing", "otp-relay-social-engineering" ], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": null, "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "Cisco identified an intrusion on May 24, 2022 and disclosed it on August 10, 2022. Cisco Talos reported that the attacker obtained an employee's credentials from a personal Google account that synced browser-saved passwords, then used voice phishing posing as trusted organizations and repeated MFA push requests until the employee accepted, reaching the corporate VPN. Cisco said it found no impact to its business, products or customer data; the attackers later published file names and contents.", "identity_lesson": "Corporate credentials should never sync into personal browser profiles, and phishing-resistant MFA would have stopped the vishing and push flood.", "sources": [ { "title": "Cisco Talos shares insights related to recent cyber attack on Cisco", "publisher": "Cisco Talos", "url": "https://blog.talosintelligence.com/recent-cyber-attack/", "date": "2022-08-10" }, { "title": "Cisco Event Response: Corporate Network Security Incident", "publisher": "Cisco", "url": "https://sec.cloudapps.cisco.com/security/center/resources/corp_network_security_incident", "date": "2022-08-10" } ], "verified_on": "2026-10-31" }, { "id": "2022-twilio-sms-phishing", "name": "Twilio breach via SMS phishing of employees", "victim": "Twilio", "industry": "b2b-saas", "country": "United States", "incident_date": "2022-08-04", "disclosed": "2022-08-07", "actor": "0ktapus (Scatter Swine)", "actor_type": "financially-motivated", "initial_access": "phishing-credentials", "identity_failure": "authentication", "mfa": "unknown", "non_human": false, "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": 209, "records_note": "209 customers (of more than 270,000) and 93 Authy users had data accessed, per Twilio's final update of October 27, 2022.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "Starting in mid-July 2022, attackers sent Twilio employees SMS messages pointing to fake login pages and used the captured credentials to access internal systems; Twilio detected the access on August 4 and disclosed on August 7, 2022. The attackers used Twilio's internal tools to view data of 209 customers and 93 Authy users. Twilio also linked a June 29, 2022 voice phishing incident, in which an employee gave up credentials, to the same actors.", "identity_lesson": "Phishing-resistant authenticators such as FIDO2 keys defeat credential-harvesting sites; Cloudflare was hit by the same campaign and stopped it that way.", "sources": [ { "title": "Incident Report: Employee and Customer Account Compromise", "publisher": "Twilio", "url": "https://www.twilio.com/en-us/blog/august-2022-social-engineering-attack", "date": "2022-08-07" }, { "title": "The mechanics of a sophisticated phishing scam and how we stopped it", "publisher": "Cloudflare", "url": "https://blog.cloudflare.com/2022-07-sms-phishing-attacks/", "date": "2022-08-09" } ], "verified_on": "2026-10-31" }, { "id": "2022-microsoft-aitm-phishing-bec", "name": "AiTM phishing campaign against more than 10,000 Microsoft 365 organizations", "victim": "Multiple: more than 10,000 organizations targeted", "industry": "cross-industry", "country": "Global", "incident_date": "2021-09", "disclosed": "2022-07-12", "actor": null, "actor_type": "financially-motivated", "initial_access": "phishing-aitm", "identity_failure": "session-and-tokens", "mfa": "bypassed", "non_human": false, "techniques": [ "aitm-phishing-proxy", "session-cookie-theft" ], "cves": [], "vendors": [ "iam/microsoft-entra" ], "teardown": null, "records_affected": null, "records_note": null, "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "Microsoft reported on July 12, 2022 that a phishing campaign had attempted to target more than 10,000 organizations since September 2021 using adversary-in-the-middle proxy sites. The proxies captured passwords and session cookies, letting attackers skip authentication even where MFA was enabled, then use mailboxes for business email compromise and payment fraud.", "identity_lesson": "Phishing-resistant MFA such as FIDO2 defeats the proxy, and token binding plus conditional access on device compliance limit replay of stolen session cookies.", "sources": [ { "title": "From cookie theft to BEC: Attackers use AiTM phishing sites as entry point to further financial fraud", "publisher": "Microsoft Security Blog", "url": "https://www.microsoft.com/en-us/security/blog/2022/07/12/from-cookie-theft-to-bec-attackers-use-aitm-phishing-sites-as-entry-point-to-further-financial-fraud/", "date": "2022-07-12" } ], "verified_on": "2026-10-31" }, { "id": "2022-t-mobile-lapsus-stolen-credentials", "name": "LAPSUS$ access to T-Mobile internal tools with stolen credentials", "victim": "T-Mobile US", "industry": "telecom", "country": "United States", "incident_date": "2022-03", "disclosed": "2022-04-22", "actor": "LAPSUS$", "actor_type": "extortion-group", "initial_access": "stolen-credentials", "identity_failure": "authentication", "mfa": "unknown", "non_human": false, "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": null, "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "In March 2022 LAPSUS$ members used stolen credentials to access T-Mobile internal systems that house operational tools, and leaked chats show they stole source code. T-Mobile told KrebsOnSecurity on April 22, 2022 that the systems contained no customer or government information and that the accounts were isolated and revoked.", "identity_lesson": "Credentials bought or phished from employees and contractors stay useful until sessions are bound to managed devices and logins require phishing-resistant MFA.", "sources": [ { "title": "Leaked Chats Show LAPSUS$ Stole T-Mobile Source Code", "publisher": "KrebsOnSecurity", "url": "https://krebsonsecurity.com/2022/04/leaked-chats-show-lapsus-stole-t-mobile-source-code/", "date": "2022-04-22" } ], "verified_on": "2026-10-31" }, { "id": "2022-github-heroku-travis-oauth-tokens", "name": "GitHub private repositories accessed with stolen Heroku and Travis CI OAuth tokens", "victim": "Multiple: GitHub, npm, Heroku and dozens of organizations", "industry": "technology", "country": "United States", "incident_date": "2022-04-07", "disclosed": "2022-04-15", "actor": null, "actor_type": "unknown", "initial_access": "oauth-token-abuse", "identity_failure": "non-human-identity", "mfa": "not-applicable", "non_human": true, "techniques": [ "secrets-in-repositories-and-ci" ], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "Dozens of organizations had data downloaded, per GitHub; Heroku also reported exfiltration of a database of customer usernames and hashed passwords.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "GitHub disclosed on April 15, 2022 that an attacker used stolen OAuth user tokens issued to Heroku and Travis CI to download data from private repositories of dozens of organizations, including npm. Heroku found the attacker had used a compromised token for a Heroku machine account, taken from an archived private repository, to download customer GitHub integration OAuth tokens from a Heroku database on April 7, 2022.", "identity_lesson": "Third-party integration tokens are standing access to your code; short lifetimes, least-scope grants and anomaly detection on token use would have contained this.", "sources": [ { "title": "Security alert: Attack campaign involving stolen OAuth user tokens issued to two third-party integrators", "publisher": "GitHub", "url": "https://github.blog/news-insights/company-news/security-alert-stolen-oauth-user-tokens/", "date": "2022-04-15" }, { "title": "April 2022 Incident Review", "publisher": "Heroku", "url": "https://www.heroku.com/blog/april-2022-incident-review", "date": "2022-05-31" } ], "verified_on": "2026-10-31" }, { "id": "2022-mailchimp-internal-tool-april", "name": "Mailchimp April 2022 support tool breach via social engineering", "victim": "Mailchimp (Intuit)", "industry": "b2b-saas", "country": "United States", "incident_date": "2022-03-26", "disclosed": "2022-04-04", "actor": null, "actor_type": "financially-motivated", "initial_access": "phishing-credentials", "identity_failure": "authentication", "mfa": "unknown", "non_human": false, "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": 319, "records_note": "319 Mailchimp accounts viewed and audience data exported from 102, per Mailchimp.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "Mailchimp found on March 26, 2022 that an attacker was using an internal tool for customer support and account administration, after employee credentials were stolen through social engineering. The attacker viewed 319 accounts, mostly in crypto and finance, exported audience data from 102, and used the data for phishing such as a campaign against Trezor users. Mailchimp confirmed the incident in early April 2022.", "identity_lesson": "Support and admin tools that can view any customer account need phishing-resistant MFA and per-session justification, not just a password.", "sources": [ { "title": "Hacker accessed 319 crypto- and finance-related Mailchimp accounts, company said", "publisher": "The Record", "url": "https://therecord.media/hacker-accessed-319-crypto-and-finance-related-mailchimp-accounts-company-said/", "date": "2022-04-04" } ], "verified_on": "2026-10-31" }, { "id": "2022-cash-app-former-employee", "name": "Cash App Investing reports downloaded by former employee", "victim": "Block (Cash App Investing)", "industry": "financial-services", "country": "United States", "incident_date": "2021-12-10", "disclosed": "2022-04-04", "actor": "Former employee", "actor_type": "insider", "initial_access": "insider-misuse", "identity_failure": "identity-lifecycle", "mfa": "unknown", "non_human": false, "techniques": [ "orphaned-account-abuse" ], "cves": [], "vendors": [], "teardown": null, "records_affected": 8200000, "records_note": "About 8.2 million current and former customers contacted, per Block's SEC 8-K.", "financial_impact_usd": 15000000, "financial_note": "Class action settlement (Salinas v. Block, Inc.), final approval reported April 2025.", "regulatory": "Reported April 4, 2025: a California federal judge in San Francisco gave final approval to a $15 million class action settlement; Block denied wrongdoing.", "summary": "On December 10, 2021 a former employee downloaded Cash App Investing reports containing customer names and brokerage account numbers, and for some customers portfolio value and holdings. The employee had regular access to the reports in their past job, but accessed them after their employment ended. Block disclosed the incident in an SEC 8-K on April 4, 2022.", "identity_lesson": "Revoking all access at termination, including to reporting tools and exports, is the control that failed; automated deprovisioning tied to HR events closes the gap.", "sources": [ { "title": "Block, Inc. Form 8-K", "publisher": "U.S. Securities and Exchange Commission", "url": "https://www.sec.gov/Archives/edgar/data/1512673/000119312522095215/d343042d8k.htm", "date": "2022-04-04" }, { "title": "Judge Approves $15 Million Settlement Of Cash App Data Breach Class Action", "publisher": "Mealey's (LexisNexis)", "url": "https://www.mealeys.com/mealeys/articles/2321187", "date": "2025-04-04" } ], "verified_on": "2026-10-31" }, { "id": "2022-ronin-bridge-validator-keys", "name": "Ronin bridge theft via compromised validator keys", "victim": "Sky Mavis (Ronin Network, Axie Infinity)", "industry": "crypto-web3", "country": "Vietnam", "incident_date": "2022-03-23", "disclosed": "2022-03-29", "actor": "Lazarus Group", "actor_type": "nation-state", "initial_access": "stolen-credentials", "identity_failure": "non-human-identity", "mfa": "not-applicable", "non_human": true, "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": null, "financial_impact_usd": 620000000, "financial_note": "Value stolen, described by the U.S. Treasury as almost $620 million (173,600 ETH and 25.5 million USDC).", "regulatory": "April 2022: FBI attributed the theft to Lazarus Group; May 6, 2022: U.S. Treasury sanctioned the Blender.io mixer, citing its use to launder Ronin proceeds.", "summary": "On March 23, 2022 attackers used private keys for five of the Ronin bridge's nine validators to sign withdrawals worth almost $620 million; the theft was found on March 29, 2022. Four keys came from Sky Mavis infrastructure, reportedly reached through a spyware-laden fake job offer sent to an engineer, and the fifth came from an Axie DAO validator allowlist granted to Sky Mavis in late 2021 that was never revoked. The FBI attributed the attack to North Korea's Lazarus Group.", "identity_lesson": "Signing keys are non-human identities that need separation across organizations and hardware, and temporary signing delegations must be revoked when the need ends.", "sources": [ { "title": "U.S. Treasury Issues First-Ever Sanctions on a Virtual Currency Mixer, Targets DPRK Cyber Threats", "publisher": "U.S. Department of the Treasury", "url": "https://home.treasury.gov/news/press-releases/jy0768", "date": "2022-05-06" }, { "title": "A fake job offer via LinkedIn allowed to steal $540M from Axie Infinity", "publisher": "Security Affairs", "url": "https://securityaffairs.com/133113/cyber-crime/axie-infinity-hack-fake-job-offer.html", "date": "2022-07-07" }, { "title": "Fake job offer leads to $600 million theft", "publisher": "Malwarebytes", "url": "https://www.malwarebytes.com/blog/news/2022/07/fake-job-offer-leads-to-600-million-theft", "date": "2022-07-07" } ], "verified_on": "2026-10-31" }, { "id": "2022-okta-sitel-lapsus", "name": "LAPSUS$ access to Okta support via Sitel engineer workstation", "victim": "Okta", "industry": "technology", "country": "United States", "incident_date": "2022-01-16", "disclosed": "2022-03-22", "actor": "LAPSUS$", "actor_type": "extortion-group", "initial_access": "third-party-access", "identity_failure": "authorization", "mfa": "unknown", "non_human": false, "techniques": [], "cves": [], "vendors": [ "iam/okta" ], "teardown": null, "records_affected": 2, "records_note": "Two customer tenants accessed, per Okta's final investigation in April 2022; the initial maximum potential impact was 366 customers.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "Between January 16 and 21, 2022 an attacker had remote access, via RDP, to a workstation of a support engineer at Okta's subprocessor Sitel, which had access to Okta support tools. LAPSUS$ posted screenshots on March 22, 2022, prompting Okta's disclosure; Okta first estimated up to 366 customers potentially affected, then concluded in April that the attacker controlled the workstation for 25 minutes on January 21 and accessed two customer tenants. Okta ended its relationship with Sitel.", "identity_lesson": "Third-party support staff with access to customer tenants need managed devices, least-privilege tooling and contractual incident reporting, since their compromise is your compromise.", "sources": [ { "title": "Okta's Investigation of the January 2022 Compromise", "publisher": "Okta", "url": "https://www.okta.com/blog/2022/03/oktas-investigation-of-the-january-2022-compromise/", "date": "2022-03-23" }, { "title": "Okta Concludes its Investigation Into the January 2022 Compromise", "publisher": "Okta", "url": "https://www.okta.com/blog/company-and-culture/okta-concludes-its-investigation-into-the-january-2022-compromise/", "date": "2022-04-19" }, { "title": "Review of the Attacks Associated with Lapsus$ and Related Threat Groups", "publisher": "Cyber Safety Review Board (CISA)", "url": "https://www.cisa.gov/sites/default/files/2023-08/CSRB_Lapsus%24_508c.pdf", "date": "2023-08-10" } ], "verified_on": "2026-10-31" }, { "id": "2022-microsoft-lapsus-account", "name": "LAPSUS$ source code theft from Microsoft via a single compromised account", "victim": "Microsoft", "industry": "technology", "country": "United States", "incident_date": "2022-03", "disclosed": "2022-03-22", "actor": "LAPSUS$ (DEV-0537)", "actor_type": "extortion-group", "initial_access": "stolen-credentials", "identity_failure": "authentication", "mfa": "unknown", "non_human": false, "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": null, "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "In March 2022 LAPSUS$ claimed to have stolen portions of Microsoft source code. Microsoft said on March 22, 2022 that a single account had been compromised, granting limited access, and that no customer code or data was involved. Microsoft's report on the group, which it tracks as DEV-0537, described its methods: buying credentials and session tokens, Redline password stealer, paying insiders, SIM swapping and spamming MFA prompts.", "identity_lesson": "Phishing-resistant MFA, device-bound sessions and alerting on unusual repository access counter every entry method Microsoft listed for this group.", "sources": [ { "title": "DEV-0537 criminal actor targeting organizations for data exfiltration and destruction", "publisher": "Microsoft Security Blog", "url": "https://www.microsoft.com/en-us/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/", "date": "2022-03-22" }, { "title": "Review of the Attacks Associated with Lapsus$ and Related Threat Groups", "publisher": "Cyber Safety Review Board (CISA)", "url": "https://www.cisa.gov/sites/default/files/2023-08/CSRB_Lapsus%24_508c.pdf", "date": "2023-08-10" } ], "verified_on": "2026-10-31" }, { "id": "2022-crypto-com-2fa-bypass", "name": "Crypto.com unauthorized withdrawals bypassing 2FA", "victim": "Crypto.com", "industry": "crypto-web3", "country": "Singapore", "incident_date": "2022-01-17", "disclosed": "2022-01-17", "actor": null, "actor_type": "financially-motivated", "initial_access": "identity-infra-vulnerability", "identity_failure": "authentication", "mfa": "bypassed", "non_human": false, "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": 483, "records_note": "483 user accounts, per Crypto.com.", "financial_impact_usd": 34000000, "financial_note": "Approximate value of unauthorized withdrawals reported by Crypto.com (about $15 million in ETH, $19 million in BTC and $66,200 in other currencies); affected customers were reimbursed.", "regulatory": null, "summary": "In January 2022 attackers made unauthorized withdrawals from 483 Crypto.com accounts, with transactions approved without the user entering the 2FA code. Crypto.com paused withdrawals on January 17, 2022, revoked all customer 2FA tokens, moved to new 2FA infrastructure and added a 24-hour delay for new withdrawal addresses. The company did not publish the exact bypass mechanism.", "identity_lesson": "Step-up authentication on high-risk actions such as adding withdrawal addresses must be enforced server side, and a delay on new payees limits what any authentication flaw can drain.", "sources": [ { "title": "2FA compromise led to $34M Crypto.com hack", "publisher": "TechCrunch", "url": "https://techcrunch.com/2022/01/20/2fa-compromise-led-to-34m-crypto-com-hack/", "date": "2022-01-20" } ], "verified_on": "2026-10-31" }, { "id": "2021-robinhood-support-vishing", "name": "Robinhood customer data theft via phone social engineering of support employee", "victim": "Robinhood Markets", "industry": "financial-services", "country": "United States", "incident_date": "2021-11-03", "disclosed": "2021-11-08", "actor": null, "actor_type": "financially-motivated", "initial_access": "phishing-credentials", "identity_failure": "authentication", "mfa": "unknown", "non_human": false, "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": 7000000, "records_note": "About 5 million email addresses plus full names for a different group of about 2 million people, per Robinhood; about 310 had more data exposed and about 10 had extensive account details revealed.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "On November 3, 2021 an attacker socially engineered a Robinhood customer support employee by phone and obtained access to customer support systems. Robinhood disclosed on November 8, 2021 that the attacker took email addresses for about 5 million people and full names for about 2 million others, then demanded an extortion payment.", "identity_lesson": "Phishing-resistant authentication for support staff and least-privilege limits on bulk export from support tools would have reduced a single phone call to a contained incident.", "sources": [ { "title": "Robinhood Announces Data Security Incident (Update)", "publisher": "Robinhood", "url": "https://newsroom.aboutrobinhood.com/robinhood-announces-data-security-incident-update/", "date": "2021-11-16" } ], "verified_on": "2026-10-31" }, { "id": "2021-nobelium-delegated-admin-privileges", "name": "Nobelium abuse of reseller delegated administrative privileges", "victim": "Multiple: cloud resellers and managed service providers and their customers", "industry": "technology", "country": "Global", "incident_date": "2021-05", "disclosed": "2021-10-24", "actor": "Nobelium (APT29)", "actor_type": "nation-state", "initial_access": "third-party-access", "identity_failure": "authorization", "mfa": "unknown", "non_human": false, "techniques": [ "password-spraying" ], "cves": [], "vendors": [ "iam/microsoft-entra" ], "teardown": null, "records_affected": 14, "records_note": "As many as 14 resellers and service providers compromised out of more than 140 targeted, per Microsoft.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "Microsoft disclosed on October 24, 2021 that since May 2021 Nobelium had targeted more than 140 cloud resellers and technology service providers, compromising as many as 14, to use their delegated administrative privileges into downstream customer tenants. Between July 1 and October 19, 2021 Microsoft saw 22,868 attack attempts against 609 customers, using password spraying, phishing and token theft.", "identity_lesson": "Delegated admin rights held by partners are standing privileged access into your tenant; removing unused delegations and moving to granular, time-bound partner roles shrinks this path.", "sources": [ { "title": "New activity from Russian actor Nobelium", "publisher": "Microsoft On the Issues", "url": "https://blogs.microsoft.com/on-the-issues/2021/10/24/new-activity-from-russian-actor-nobelium/", "date": "2021-10-24" }, { "title": "NOBELIUM targeting delegated administrative privileges to facilitate broader attacks", "publisher": "Microsoft Security Blog", "url": "https://www.microsoft.com/en-us/security/blog/2021/10/25/nobelium-targeting-delegated-administrative-privileges-to-facilitate-broader-attacks/", "date": "2021-10-25" } ], "verified_on": "2026-10-31" }, { "id": "2021-coinbase-sms-recovery-flaw", "name": "Coinbase account takeovers via SMS account recovery flaw", "victim": "Coinbase", "industry": "crypto-web3", "country": "United States", "incident_date": "2021-03", "disclosed": "2021-10-01", "actor": null, "actor_type": "financially-motivated", "initial_access": "identity-infra-vulnerability", "identity_failure": "authentication", "mfa": "bypassed", "non_human": false, "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": 6000, "records_note": "At least 6,000 customers had funds stolen, per Coinbase's notification letter filed with the California Attorney General.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "Between March and May 20, 2021, attackers who already had victims' email addresses, passwords and phone numbers abused a flaw in Coinbase's SMS account recovery process to obtain the SMS two-factor codes needed to take over accounts. Coinbase disclosed the thefts in a notification letter reported on October 1, 2021, said it updated its SMS account recovery protocols, and reimbursed affected customers.", "identity_lesson": "Account recovery must be as strong as login: recovery paths that fall back to SMS codes undo the protection of the primary factor, and TOTP or security keys remove that path.", "sources": [ { "title": "MFA Glitch Leads to 6K+ Coinbase Customers Getting Robbed", "publisher": "Threatpost", "url": "https://threatpost.com/mfa-glitch-coinbase-customers-robbery/175290/", "date": "2021-10-01" }, { "title": "Hackers exploit 2FA flaw to steal crypto from 6,000 Coinbase users", "publisher": "Hackread", "url": "https://www.hackread.com/hackers-exploit-2fa-flaw-steal-coinbase-crypto/", "date": "2021-10-02" } ], "verified_on": "2026-10-31" }, { "id": "2021-nobelium-password-spray-support-agent", "name": "Nobelium password spray campaign and Microsoft support agent compromise", "victim": "Multiple: Microsoft customers, mainly IT companies and government", "industry": "cross-industry", "country": "Global", "incident_date": null, "disclosed": "2021-06-25", "actor": "Nobelium (APT29)", "actor_type": "nation-state", "initial_access": "password-spraying", "identity_failure": "authentication", "mfa": "unknown", "non_human": false, "techniques": [ "password-spraying", "infostealer-credential-harvesting" ], "cves": [], "vendors": [], "teardown": null, "records_affected": 3, "records_note": "Microsoft said it was aware of three compromised entities.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "On June 25, 2021 Microsoft reported Nobelium password spray and brute-force attacks against customers, mostly IT companies (57%) and government (20%) across 36 countries, with three compromised entities known. Microsoft also found information-stealing malware on a device belonging to one of its customer support agents, whose access to basic customer account information the actor used for targeted attacks.", "identity_lesson": "Blocking legacy authentication and enforcing MFA stops password spraying, and least-privilege support tooling limits what a compromised support agent can expose.", "sources": [ { "title": "New Nobelium activity", "publisher": "Microsoft Security Response Center", "url": "https://www.microsoft.com/en-us/msrc/blog/2021/06/new-nobelium-activity", "date": "2021-06-25" } ], "verified_on": "2026-10-31" }, { "id": "2021-electronic-arts-slack-cookie", "name": "Electronic Arts source code theft via purchased Slack cookie", "victim": "Electronic Arts", "industry": "gaming", "country": "United States", "incident_date": null, "disclosed": "2021-06-10", "actor": null, "actor_type": "financially-motivated", "initial_access": "session-token-theft", "identity_failure": "session-and-tokens", "mfa": "bypassed", "non_human": false, "techniques": [ "session-cookie-theft", "help-desk-social-engineering" ], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "No player data accessed, per EA. Attackers claimed about 780 GB of source code and tools, including FIFA 21 and the Frostbite engine.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "In June 2021 attackers stole game source code and internal tools from Electronic Arts. They told Motherboard they bought a stolen session cookie for EA's Slack for $10, used it to enter an EA Slack channel, then asked EA IT support for a multifactor authentication token to reach the corporate network; EA confirmed the outline of this account to Motherboard. The data was later dumped after a failed extortion attempt.", "identity_lesson": "Slack sessions bound to managed devices, and an IT support process that verifies identity before issuing MFA tokens, would have stopped both the cookie replay and the follow-on request.", "sources": [ { "title": "How Hackers Used Slack to Break into EA Games", "publisher": "Vice Motherboard", "url": "https://www.vice.com/en/article/how-ea-games-was-hacked-slack", "date": "2021-06-11" }, { "title": "Electronic Arts hackers say Slack was their secret weapon", "publisher": "Gizmodo", "url": "https://gizmodo.com/electronic-arts-hackers-say-slack-was-their-secret-weap-1847083532", "date": "2021-06-11" }, { "title": "Hackers leak full EA data after failed extortion attempt", "publisher": "The Record", "url": "https://therecord.media/hackers-leak-full-ea-data-after-failed-extortion-attempt/", "date": "2021-07-26" } ], "verified_on": "2026-10-31" }, { "id": "2021-colonial-pipeline-legacy-vpn", "name": "Colonial Pipeline ransomware via legacy VPN account", "victim": "Colonial Pipeline Company", "industry": "energy-utilities", "country": "United States", "incident_date": "2021-04", "disclosed": "2021-05-08", "actor": "DarkSide", "actor_type": "extortion-group", "initial_access": "stolen-credentials", "identity_failure": "identity-lifecycle", "mfa": "absent", "non_human": false, "techniques": [ "orphaned-account-abuse" ], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": null, "financial_impact_usd": 4400000, "financial_note": "Ransom of about $4.4 million paid in bitcoin, as stated by CEO Joseph Blount; the Justice Department later seized about 63.7 BTC (about $2.3 million) of it.", "regulatory": null, "summary": "DarkSide affiliates logged into Colonial Pipeline's network through a legacy VPN profile that the company believed was no longer in use, using a valid password. The ransomware attack that followed led Colonial to shut down its fuel pipeline in May 2021. CEO Joseph Blount told the Senate on June 8, 2021 that the legacy VPN had only single-factor authentication; how the password was obtained was not determined.", "identity_lesson": "An inventory of every remote access account, with dormant profiles disabled and MFA enforced on all VPN logins, would have closed the door DarkSide walked through.", "sources": [ { "title": "Hackers Only Needed a Single Password to Disrupt Colonial Pipeline, CEO Testifies", "publisher": "Insurance Journal (Bloomberg)", "url": "https://www.insurancejournal.com/news/national/2021/06/09/617870.htm", "date": "2021-06-09" }, { "title": "Department of Justice Seizes $2.3 Million in Cryptocurrency Paid to the Ransomware Extortionists Darkside", "publisher": "U.S. Department of Justice", "url": "https://www.justice.gov/opa/pr/department-justice-seizes-23-million-cryptocurrency-paid-ransomware-extortionists-darkside", "date": "2021-06-07" } ], "verified_on": "2026-10-31" }, { "id": "2021-pulse-connect-secure-exploitation", "name": "Pulse Connect Secure VPN exploitation and credential harvesting", "victim": "Multiple: U.S. government agencies, critical infrastructure and private sector", "industry": "cross-industry", "country": "Global", "incident_date": "2020-06", "disclosed": "2021-04-20", "actor": null, "actor_type": "unknown", "initial_access": "identity-infra-vulnerability", "identity_failure": "authentication", "mfa": "bypassed", "non_human": false, "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": null, "financial_impact_usd": null, "financial_note": null, "regulatory": "April 20, 2021: CISA Emergency Directive 21-03 ordered federal agencies to assess and mitigate Pulse Connect Secure appliances.", "summary": "On April 20, 2021 CISA reported active exploitation of Pulse Connect Secure remote access appliances, including the newly disclosed CVE-2021-22893, with activity dating to June 2020 or earlier. Attackers modified legitimate Pulse files such as Login.cgi to place webshells that harvested credentials of authenticated users and enabled authentication bypass, giving persistent access to agency and private sector networks.", "identity_lesson": "Remote access gateways are identity infrastructure: patch them on emergency timelines, and assume every credential that passed through a compromised appliance must be reset.", "sources": [ { "title": "Exploitation of Pulse Connect Secure Vulnerabilities (AA21-110A)", "publisher": "CISA", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-110a", "date": "2021-04-20" }, { "title": "ED 21-03: Mitigate Pulse Connect Secure Product Vulnerabilities", "publisher": "CISA", "url": "https://www.cisa.gov/news-events/directives/ed-21-03-mitigate-pulse-connect-secure-product-vulnerabilities", "date": "2021-04-20" } ], "verified_on": "2026-10-31" }, { "id": "2021-codecov-bash-uploader", "name": "Codecov Bash Uploader compromise via credential extracted from Docker image", "victim": "Codecov and its customers", "industry": "technology", "country": "United States", "incident_date": "2021-01-31", "disclosed": "2021-04-15", "actor": null, "actor_type": "unknown", "initial_access": "exposed-secrets", "identity_failure": "non-human-identity", "mfa": "not-applicable", "non_human": true, "techniques": [ "secrets-in-repositories-and-ci", "static-api-key-abuse" ], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "Customer count not disclosed by Codecov.", "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "An error in Codecov's Docker image creation process let an attacker extract a Google Cloud Storage credential, which was used from January 31, 2021 to modify Codecov's Bash Uploader script. The altered script sent environment variables, including credentials and tokens, from customers' CI pipelines to the attacker. A customer spotted a checksum mismatch on April 1, 2021 and Codecov disclosed on April 15, 2021.", "identity_lesson": "Short-lived, narrowly scoped credentials kept out of build artifacts, plus CI pipelines that do not expose long-lived secrets as environment variables, would have limited both the initial access and the downstream harvest.", "sources": [ { "title": "Bash Uploader Security Update", "publisher": "Codecov", "url": "https://about.codecov.io/security-update/", "date": "2021-04-15" }, { "title": "Codecov Releases New Detections for Supply Chain Compromise", "publisher": "CISA", "url": "https://www.cisa.gov/news-events/alerts/2021/04/30/codecov-releases-new-detections-supply-chain-compromise", "date": "2021-04-30" } ], "verified_on": "2026-10-31" }, { "id": "2021-verkada-super-admin-credentials", "name": "Verkada camera platform access via exposed admin credentials", "victim": "Verkada", "industry": "technology", "country": "United States", "incident_date": "2021-03", "disclosed": "2021-03-09", "actor": null, "actor_type": "unknown", "initial_access": "exposed-secrets", "identity_failure": "authorization", "mfa": "unknown", "non_human": false, "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": "Up to about 150,000 cameras were reachable; Verkada said the intruder viewed cameras of 97 customers.", "financial_impact_usd": 2950000, "financial_note": "Civil penalty in the 2024 FTC and DOJ settlement; it was tied to CAN-SPAM violations, not the security incident itself.", "regulatory": "August 30, 2024: FTC and DOJ settlement requiring a security program and independent assessments, with a $2.95 million civil penalty for CAN-SPAM violations. Verkada neither admitted nor denied the allegations.", "summary": "In March 2021 intruders used an administrator-level username and password left exposed online to enter Verkada's systems, gaining access across the company's customer camera platform, including live feeds at hospitals, factories and a jail. The FTC later alleged Verkada failed to use appropriate security measures, and settled with the company in August 2024.", "identity_lesson": "Support super-admin accounts that span every tenant need MFA, just-in-time access and secret scanning; one leaked credential should never reach every customer.", "sources": [ { "title": "CCTV biz Verkada pays $3M to settle FTC complaint", "publisher": "The Register", "url": "https://www.theregister.com/2024/09/05/verkada_ftc_settlement/", "date": "2024-09-05" }, { "title": "$2.95M Penalty and Permanent Injunction Resolves Lawsuit Against Verkada Inc. for Alleged Unlawful Commercial Emails, Data Security Failures and Deceptive Practices", "publisher": "U.S. Department of Justice", "url": "https://www.justice.gov/opa/pr/295m-penalty-and-permanent-injunction-resolves-lawsuit-against-verkada-inc-alleged-unlawful", "date": "2024-08-30" } ], "verified_on": "2026-10-31" }, { "id": "2021-malwarebytes-service-principal-abuse", "name": "Malwarebytes email access via abused Microsoft 365 application", "victim": "Malwarebytes", "industry": "technology", "country": "United States", "incident_date": "2020-12", "disclosed": "2021-01-19", "actor": "SolarWinds Orion threat actor (Nobelium)", "actor_type": "nation-state", "initial_access": "oauth-token-abuse", "identity_failure": "non-human-identity", "mfa": "not-applicable", "non_human": true, "techniques": [], "cves": [], "vendors": [ "iam/microsoft-entra" ], "teardown": null, "records_affected": null, "records_note": null, "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "Malwarebytes disclosed on January 19, 2021 that the actor behind the SolarWinds breach abused applications with privileged access to its Microsoft Office 365 and Azure environments. The attacker added a self-signed certificate with credentials to a service principal and used it to read a limited subset of internal email through Microsoft Graph. Microsoft alerted Malwarebytes on December 15, 2020; Malwarebytes does not use SolarWinds.", "identity_lesson": "Monitoring for new credentials added to service principals, and removing unneeded mail-read permissions from applications, would have flagged or blocked this path.", "sources": [ { "title": "Malwarebytes targeted by Nation State Actor implicated in SolarWinds breach. Evidence suggests abuse of privileged access to Microsoft Office 365 and Azure environments", "publisher": "Malwarebytes", "url": "https://www.malwarebytes.com/blog/news/2021/01/malwarebytes-targeted-by-nation-state-actor-implicated-in-solarwinds-breach", "date": "2021-01-19" }, { "title": "Malwarebytes breached by SolarWinds hackers", "publisher": "TechTarget SearchSecurity", "url": "https://www.techtarget.com/searchsecurity/news/252495069/Malwarebytes-breached-by-SolarWinds-hackers", "date": "2021-01-19" } ], "verified_on": "2026-10-31" }, { "id": "2021-mimecast-certificate-compromise", "name": "Mimecast Microsoft 365 connection certificate stolen by SolarWinds actor", "victim": "Mimecast and its customers", "industry": "technology", "country": "United Kingdom", "incident_date": null, "disclosed": "2021-01-12", "actor": "SolarWinds Orion threat actor (Nobelium)", "actor_type": "nation-state", "initial_access": "supply-chain", "identity_failure": "non-human-identity", "mfa": "not-applicable", "non_human": true, "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": null, "financial_impact_usd": null, "financial_note": null, "regulatory": null, "summary": "On January 12, 2021 Mimecast disclosed that a certificate used to authenticate its Sync and Recover, Continuity Monitor and Internal Email Protect products to Microsoft 365 Exchange Web Services had been compromised, after Microsoft alerted it. Mimecast later confirmed the incident was tied to the SolarWinds Orion compromise and the same actor; Microsoft blocked the certificate and customers re-created their connections.", "identity_lesson": "A single shared certificate trusted by thousands of tenants is a high-value non-human credential; per-tenant credentials with rotation and use monitoring cap the blast radius.", "sources": [ { "title": "Mimecast certificate compromised by SolarWinds hackers", "publisher": "TechTarget SearchSecurity", "url": "https://www.techtarget.com/searchsecurity/news/252495395/Mimecast-certificate-compromised-by-SolarWinds-hackers", "date": "2021-01-12" }, { "title": "Hackers Steal Mimecast Certificate Used to Securely Connect with Microsoft 365", "publisher": "The Hacker News", "url": "https://thehackernews.com/2021/01/hackers-steal-mimecast-certificate-used.html", "date": "2021-01-13" } ], "verified_on": "2026-10-31" }, { "id": "2021-ubiquiti-insider-cloud-credentials", "name": "Ubiquiti data theft and extortion by insider with cloud admin credentials", "victim": "Ubiquiti", "industry": "technology", "country": "United States", "incident_date": "2020-12", "disclosed": "2021-01-11", "actor": "Nickolas Sharp (former employee)", "actor_type": "insider", "initial_access": "insider-misuse", "identity_failure": "authorization", "mfa": "unknown", "non_human": false, "techniques": [], "cves": [], "vendors": [], "teardown": null, "records_affected": null, "records_note": null, "financial_impact_usd": null, "financial_note": null, "regulatory": "Sharp was charged in December 2021, pleaded guilty in February 2023, and was sentenced on May 10, 2023 to six years in prison and ordered to pay $1,590,487 in restitution.", "summary": "In December 2020 a senior Ubiquiti developer used his own administrative access to the company's AWS and GitHub environments to steal gigabytes of confidential data, then posed as an outside hacker and demanded 50 bitcoin. Ubiquiti told customers on January 11, 2021 to change passwords after unauthorized access to systems hosted by a third-party cloud provider. Federal prosecutors charged the employee in December 2021.", "identity_lesson": "Broad standing admin access to cloud and code repositories in a single person's hands is the risk; just-in-time elevation and alerting on bulk cloning and log tampering would have exposed the theft.", "sources": [ { "title": "Ex-Ubiquiti dev-turned-extortionist gets 6 years in prison", "publisher": "The Register", "url": "https://www.theregister.com/2023/05/12/exubiquiti_developer_jailed/", "date": "2023-05-12" }, { "title": "Former Ubiquiti employee charged with hacking and extorting company", "publisher": "The Record", "url": "https://therecord.media/former-ubiquiti-employee-charged-with-hacking-and-extorting-company/", "date": "2021-12-01" } ], "verified_on": "2026-10-31" } ] }