# fan-out-breach

Source: https://startwithidentity.com/glossary/fan-out-breach/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

A fan-out breach is an incident in which one compromised identity or credential store at a provider (a support account, an integration's OAuth tokens, an app secret, a CI credential, a package publisher token) is used, or exposed for use, against many separate customer organizations. The term was coined by Start with Identity in the [Identity Breach Report 2026](https://startwithidentity.com/reports/identity-breach-report-2026/), which also defines the **fan-out** as the number of downstream organizations, tenants or repositories reached.

In the report's [Identity Breach Database](https://startwithidentity.com/breaches/incidents/), 19 of 120 incidents (15.8%) are fan-out breaches, rising to 10 of 48 (20.8%) of those disclosed in 2025-2026, and 14 of the 19 abused a non-human identity. Examples include [Okta via Sitel](https://startwithidentity.com/breaches/incidents/2022-okta-sitel-lapsus/), [CircleCI](https://startwithidentity.com/breaches/incidents/2023-circleci-engineer-session-token-theft/) and the [Salesloft Drift OAuth token theft](https://startwithidentity.com/breaches/incidents/2025-salesloft-drift-oauth-token-theft/). The report distinguishes these from shared-platform campaigns such as Snowflake 2024, where attackers broke into many customer accounts one by one with no compromise of the provider. The difference decides who has to act: a fan-out breach is the provider's identity problem (scope, rotate and revoke integration credentials), while each customer limits the blast radius with time-bound, least-privilege third-party access and IP restrictions on connected apps.

See also: [MFA blind zone](https://startwithidentity.com/glossary/mfa-blind-zone/), [non-human identity](https://startwithidentity.com/glossary/nhi/), [token theft](https://startwithidentity.com/glossary/token-theft/), [refresh token abuse](https://startwithidentity.com/techniques/refresh-token-abuse/), [secrets in repositories and CI](https://startwithidentity.com/techniques/secrets-in-repositories-and-ci/), [Shared Signals Framework](https://startwithidentity.com/standards/shared-signals-framework/)