Fan-Out Breach
A fan-out breach is an incident in which one compromised identity or credential store at a provider (a support account, an integration's OAuth tokens, an app secret, a CI credential, a package publisher token) is used, or exposed for use, against many separate customer organizations. The term was coined by Start with Identity in the Identity Breach Report 2026, which also defines the fan-out as the number of downstream organizations, tenants or repositories reached.
In the report's Identity Breach Database, 19 of 115 incidents (16.5%) are fan-out breaches, rising to 10 of 43 (23.3%) of those disclosed in 2025-2026, and 14 of the 19 abused a non-human identity. Examples include Okta via Sitel, CircleCI and the Salesloft Drift OAuth token theft. The report distinguishes these from shared-platform campaigns such as Snowflake 2024, where attackers broke into many customer accounts one by one with no compromise of the provider. The difference decides who has to act: a fan-out breach is the provider's identity problem (scope, rotate and revoke integration credentials), while each customer limits the blast radius with time-bound, least-privilege third-party access and IP restrictions on connected apps.
See also: MFA blind zone, non-human identity, token theft, refresh token abuse, secrets in repositories and CI, Shared Signals Framework
Related on Start with Identity
- GlossaryPrompt Injection
Prompt injection is a vulnerability in which input to a large language model alters its behavior or output in ways its developer did not intend, for example mak
- GlossaryClient Credentials Grant
An OAuth 2.0 flow where an application authenticates as itself, with no user present, to obtain an access token. The standard pattern for machine-to-machine acc
- GlossaryInstance Metadata Service (IMDS)
The instance metadata service (IMDS) is an HTTP endpoint reachable only from inside a cloud virtual machine, at 169.254.169.254 on AWS EC2, that returns data ab
- BlogASOS breach began with an employee tricked out of their login
ASOS says an attacker impersonated a trusted contact to get an employee's login credentials, then used them to reach customer names and contact details on third
- BlogA Check Point SmartConsole flaw hands out full admin tokens to unauthenticated attackers
CVE-2026-16232 (CVSS 9.3) lets an unauthenticated remote attacker obtain an application login token for Check Point Security Management and Multi-Domain Managem
- BlogChick-fil-A's second credential stuffing breach in three years hit 13,322 loyalty accounts
Automated login attempts using credentials obtained from a third-party source, not a Chick-fil-A breach, compromised 13,322 Chick-fil-A One loyalty accounts ove