# Identity Breach Report 2026: how attackers get in

Source: https://startwithidentity.com/reports/identity-breach-report-2026/
Last updated: 2026-10-31
License: content by Start with Identity. Cite the source URL.

---

Attackers in identity breaches are getting past MFA more often than they find it missing, and a growing share of breaches never touch a login at all. Of 115 identity breaches in the Start with Identity [Identity Breach Database](https://startwithidentity.com/breaches/incidents/), disclosed from January 2021 to October 2026, MFA status is on record for 40: **MFA was bypassed in 25 and absent in 15**. In 2025-2026, **41.4% of breaches on human accounts began with social engineering of a person** (12 of 29), up from 24.1% two years earlier, while stolen and reused passwords fell from 51.7% to 17.2%. And **in 46.5% of 2025-2026 breaches (20 of 43) the abused path had no interactive login for MFA to protect**, usually because the identity was a service account, token or OAuth app.

We call those two shifts the **talk-past attack** and the **MFA blind zone**. A third pattern, the **fan-out breach**, explains the largest blast radii in the data: one compromised identity at a provider reaching many customers, as with [Okta](https://startwithidentity.com/vendors/iam/okta/) support, Salesloft Drift and the ConnectWise Cloud Backup app. All three terms are defined below. Every number in this report comes from a script anyone can re-run against the public dataset, and the controls section ties each recommendation to the incidents it would have changed.

## Methodology

**Inclusion rule.** An incident is in the database when it is a breach or intrusion disclosed from 1 January 2021 to the snapshot date in which identity was the initial access path or the decisive step: credentials, sessions, tokens, MFA, the help desk, federation, the directory, service accounts, secrets, or a flaw in identity infrastructure. Generic ransomware with no documented identity angle is excluded, and so are attacker claims that neither the victim nor credible press confirmed. The full rule and field definitions are in the [database schema](https://startwithidentity.com/breaches/incidents/).

**What is in it.** 115 incidents, first disclosed between 11 January 2021 and 22 October 2026, from 13 countries and 15 industry groups. Each record cites its sources (234 in all, and 89 of the 115 records cite two or more), preferring the victim's statement, an SEC filing, a regulator or a named security firm. All records were re-verified on 31 October 2026. 16 records are covered by one of the six SWI [breach teardowns](https://startwithidentity.com/breaches/), 10 cite an exploited CVE, and 66 map to at least one [attack technique](https://startwithidentity.com/techniques/).

**Periods.** Incidents are grouped by disclosure date: 2021-2022 (33 incidents), 2023-2024 (39) and 2025-2026 (43). The last period covers 22 months, to 22 October 2026, not 24.

**Classification.** Each record carries one value for initial access (17 vectors), one failed identity control (the seven control families in the [technique taxonomy](https://startwithidentity.com/techniques/)), MFA status (absent, bypassed, not applicable, or unknown), a non-human flag, an actor as attributed by the victim or a named security firm, and an actor type. For trend analysis we group the 17 vectors into six families: social engineering of a person (help desk, credential phishing, adversary-in-the-middle phishing, consent phishing, MFA fatigue, SIM swap), stolen, stuffed or sprayed passwords, stolen tokens and exposed secrets, identity infrastructure flaws, trusted third parties and supply chain, and insiders. A few classifications are not record fields (voice-led access, fan-out breaches, the unit of a records count, the type of a dollar figure). Each is an explicit list in the script with a reason per incident, and the script fails if a listed record does not contain the supporting text.

**Limits, stated plainly.** This is a curated set, not a census. It measures what is known about identity breaches, not all of them. It leans toward incidents that were disclosed, investigated and reported in English, toward the US and Europe, and toward large or technical victims whose security teams publish root causes. The 2025-2026 records are newer, so fewer of them have finished investigations, regulatory outcomes or final victim counts. MFA status is unknown for 37 records, all of them on human accounts. Where a share moves between periods by two or three incidents, read it as a direction, not a rate. Several records describe one campaign from different victims (five cover the Snowflake campaign), and we say so wherever that affects a count.

## Finding 1: the talk-past shift

Across the whole database the most common single way in is still a stolen password, but the mix has moved.

| Initial access | All (115) | 2021-2022 (33) | 2023-2024 (39) | 2025-2026 (43) |
|---|---|---|---|---|
| Stolen credentials | 22 (19.1%) | 6 (18.2%) | 13 (33.3%) | 3 (7.0%) |
| Credential phishing | 18 (15.7%) | 5 (15.2%) | 3 (7.7%) | 10 (23.3%) |
| Identity infrastructure vulnerability | 16 (13.9%) | 3 (9.1%) | 5 (12.8%) | 8 (18.6%) |
| Exposed secrets | 9 (7.8%) | 2 (6.1%) | 4 (10.3%) | 3 (7.0%) |
| Third-party access | 9 (7.8%) | 4 (12.1%) | 2 (5.1%) | 3 (7.0%) |
| Credential stuffing | 7 (6.1%) | 0 | 5 (12.8%) | 2 (4.7%) |
| Supply chain | 6 (5.2%) | 1 (3.0%) | 0 | 5 (11.6%) |
| Help desk social engineering | 5 (4.3%) | 0 | 4 (10.3%) | 1 (2.3%) |
| OAuth token abuse | 5 (4.3%) | 2 (6.1%) | 0 | 3 (7.0%) |
| Session or token theft | 4 (3.5%) | 2 (6.1%) | 1 (2.6%) | 1 (2.3%) |
| Insider misuse | 3 (2.6%) | 2 (6.1%) | 0 | 1 (2.3%) |
| Password spraying | 3 (2.6%) | 1 (3.0%) | 1 (2.6%) | 1 (2.3%) |
| Phishing (adversary-in-the-middle) | 3 (2.6%) | 2 (6.1%) | 0 | 1 (2.3%) |
| Consent phishing | 2 (1.7%) | 0 | 1 (2.6%) | 1 (2.3%) |
| MFA fatigue | 2 (1.7%) | 2 (6.1%) | 0 | 0 |
| Misconfiguration | 1 (0.9%) | 1 (3.0%) | 0 | 0 |

The 2023-2024 column is dominated by passwords that simply worked: the [Snowflake customer campaign](https://startwithidentity.com/breaches/incidents/2024-snowflake-customer-tenant-campaign/) and four of its victims, [Change Healthcare](https://startwithidentity.com/breaches/incidents/2024-change-healthcare-citrix-no-mfa/), and credential stuffing at [23andMe](https://startwithidentity.com/breaches/incidents/2023-23andme-credential-stuffing-dna-relatives/), [PayPal](https://startwithidentity.com/breaches/incidents/2023-paypal-credential-stuffing/), [Roku](https://startwithidentity.com/breaches/incidents/2024-roku-credential-stuffing/), [Chick-fil-A](https://startwithidentity.com/breaches/incidents/2023-chick-fil-a-credential-stuffing/) and [Norton](https://startwithidentity.com/breaches/incidents/2023-norton-lifelock-credential-stuffing/). In 2025-2026 those almost disappear and credential phishing becomes the top vector.

The shift is clearest on human accounts, the only place a person can be persuaded:

| Initial access family, human accounts only | All (86) | 2021-2022 (28) | 2023-2024 (29) | 2025-2026 (29) |
|---|---|---|---|---|
| Social engineering of a person | 28 (32.6%) | 9 (32.1%) | 7 (24.1%) | 12 (41.4%) |
| Stolen, stuffed or sprayed passwords | 26 (30.2%) | 6 (21.4%) | 15 (51.7%) | 5 (17.2%) |
| Identity infrastructure flaws | 17 (19.8%) | 4 (14.3%) | 5 (17.2%) | 8 (27.6%) |
| Trusted third parties and supply chain | 6 (7.0%) | 4 (14.3%) | 1 (3.4%) | 1 (3.4%) |
| Stolen tokens and exposed secrets | 6 (7.0%) | 3 (10.7%) | 1 (3.4%) | 2 (6.9%) |
| Insider misuse | 3 (3.5%) | 2 (7.1%) | 0 | 1 (3.4%) |

**Definition: talk-past attack.** Initial access gained by persuading a person to hand over, reset or approve access (credential phishing by email, text or phone, a help desk reset, an OAuth consent grant, a push approval, or a SIM swap), so that authentication is satisfied rather than broken. The **talk-past share** is the share of human-account incidents whose initial access is in that family. It was 32.1% in 2021-2022, 24.1% in 2023-2024 and 41.4% in 2025-2026.

The targets changed too. **7 of the 13 social engineering incidents in 2025-2026 involved CRM or SaaS data**: [UNC6040's Salesforce campaign](https://startwithidentity.com/breaches/incidents/2025-unc6040-salesforce-vishing-campaign/), [Allianz Life](https://startwithidentity.com/breaches/incidents/2025-allianz-life-crm-social-engineering/), [Cisco](https://startwithidentity.com/breaches/incidents/2025-cisco-crm-vishing/), [Workday](https://startwithidentity.com/breaches/incidents/2025-workday-crm-social-engineering/), [Mixpanel](https://startwithidentity.com/breaches/incidents/2025-mixpanel-smishing-openai-api-users/), the [University of Pennsylvania](https://startwithidentity.com/breaches/incidents/2025-upenn-development-systems-social-engineering/) and [ASOS](https://startwithidentity.com/breaches/incidents/2026-asos-employee-credential-theft/). In UNC6040's version, the caller posed as IT support and talked the employee into authorizing a modified Data Loader connected app in [Salesforce](https://startwithidentity.com/vendors/ciam/salesforce-identity/). No software flaw was involved, and no password had to be cracked: the employee approved the attacker's app.

We tested five hypotheses against the periods:

| Hypothesis | 2021-2022 (33) | 2023-2024 (39) | 2025-2026 (43) | Verdict |
|---|---|---|---|---|
| Help desk social engineering is rising (initial access field) | 0 | 4 (10.3%) | 1 (2.3%) | Not supported: it peaked in 2023-2024 |
| Voice-led attacks are rising (record documents a phone call) | 2 (6.1%) | 4 (10.3%) | 4 (9.3%) | Partly: up from 2021-2022, flat since |
| OAuth token and consent abuse is rising | 2 (6.1%) | 1 (2.6%) | 4 (9.3%) | Supported, on small counts |
| MFA fatigue is falling (field or technique) | 2 (6.1%) | 0 | 0 | Supported |
| Non-human identity share is rising | 5 (15.2%) | 10 (25.6%) | 14 (32.6%) | Supported |

The help desk result needs care. The four 2023-2024 cases ([Okta customers' service desks](https://startwithidentity.com/breaches/incidents/2023-okta-customer-help-desk-super-admin-takeover/), [Clorox](https://startwithidentity.com/breaches/incidents/2023-clorox-help-desk-password-reset/), [MGM Resorts](https://startwithidentity.com/breaches/incidents/2023-mgm-resorts-help-desk-ransomware/) and [Caesars](https://startwithidentity.com/breaches/incidents/2023-caesars-it-vendor-social-engineering/)) were one wave, covered in our [Scattered Spider teardown](https://startwithidentity.com/breaches/scattered-spider-helpdesk-social-engineering/), and only [Marks & Spencer](https://startwithidentity.com/breaches/incidents/2025-marks-and-spencer-third-party-impersonation/) follows in 2025-2026. The phone did not go quiet. It moved from "reset my MFA" to "approve this app" and "log in here", which the database records as consent phishing or credential phishing. Counting help desk and voice-led incidents together gives 2 (6.1%), 5 (12.8%) and 5 (11.6%). MFA fatigue, the push-spam technique behind [Uber](https://startwithidentity.com/breaches/incidents/2022-uber-mfa-fatigue/) and [Cisco](https://startwithidentity.com/breaches/incidents/2022-cisco-vishing-mfa-fatigue/) in 2022 ([teardown](https://startwithidentity.com/breaches/mfa-fatigue-push-bombing/)), has no recorded case since. Number matching in authenticator apps is the likely reason, though the data cannot prove it.

Two other vectors grew: identity infrastructure flaws (3, 5, then 8 incidents) and software supply chain (1, 0, then 5). The infrastructure cases are the edge appliances analyzed in the companion [Identity Vulnerability Report 2026](https://startwithidentity.com/reports/identity-vulnerability-report-2026/), from [Citrix Bleed](https://startwithidentity.com/cves/cve-2023-4966/) to [FortiCloud SSO](https://startwithidentity.com/cves/cve-2025-59718/) and [Ivanti Connect Secure](https://startwithidentity.com/cves/cve-2026-104935/).

## Finding 2: MFA was bypassed more often than it was missing

| MFA on the abused account | All (115) | 2021-2022 (33) | 2023-2024 (39) | 2025-2026 (43) |
|---|---|---|---|---|
| Present and bypassed | 25 (21.7%) | 10 (30.3%) | 10 (25.6%) | 5 (11.6%) |
| Not enforced | 15 (13.0%) | 2 (6.1%) | 12 (30.8%) | 1 (2.3%) |
| Not applicable (no interactive login) | 38 (33.0%) | 7 (21.2%) | 11 (28.2%) | 20 (46.5%) |
| Not disclosed | 37 (32.2%) | 14 (42.4%) | 6 (15.4%) | 17 (39.5%) |

Where the record says, **MFA was bypassed in 25 of 40 cases (62.5%)**. How it was bypassed:

| How MFA was bypassed (25 incidents) | Incidents |
|---|---|
| A person handed over or approved access | 13 |
| ... credential phishing that captured a one-time code | 3 |
| ... adversary-in-the-middle proxy | 3 |
| ... help desk reset MFA for an impostor | 3 |
| ... OAuth consent with no MFA prompt | 2 |
| ... push spam (MFA fatigue) | 2 |
| A flaw in identity infrastructure skipped the MFA step | 8 |
| A session or token was stolen after MFA | 3 |
| Stolen password plus a trusted device cookie | 1 |

The phishing cases are instructive because the victims had good MFA by the standards of their day. [Dropbox](https://startwithidentity.com/breaches/incidents/2022-dropbox-github-phishing/) staff passed one-time passwords from hardware keys to a fake login page. At [Retool](https://startwithidentity.com/breaches/incidents/2023-retool-sms-phishing-authenticator-sync/), a caller with a deepfaked voice collected a code, and [Google Authenticator](https://startwithidentity.com/vendors/mfa/google-authenticator/) cloud sync had already put the employee's other MFA seeds in the compromised Google account. At [Cyberhaven](https://startwithidentity.com/breaches/incidents/2024-cyberhaven-chrome-extension-oauth-consent-phishing/), the employee had Google Advanced Protection and still received no MFA prompt, because an OAuth consent grant is not a login. At [CircleCI](https://startwithidentity.com/breaches/incidents/2023-circleci-engineer-session-token-theft/), malware stole an SSO session that was already backed by 2FA. Only the first of these is stopped by switching codes to phishing-resistant MFA. The others need session binding and consent controls.

The 15 missing-MFA cases are more uniform. Every one began with a password that worked: stolen credentials (8), credential stuffing (5) or password spraying (2). They include [Colonial Pipeline's](https://startwithidentity.com/breaches/incidents/2021-colonial-pipeline-legacy-vpn/) legacy VPN, [Medibank's](https://startwithidentity.com/breaches/incidents/2022-medibank-contractor-credentials-vpn/) contractor VPN, Change Healthcare's Citrix portal, the Snowflake tenants, and [Midnight Blizzard's](https://startwithidentity.com/breaches/incidents/2024-microsoft-midnight-blizzard-password-spray/) spray of a legacy [Microsoft Entra ID](https://startwithidentity.com/vendors/iam/microsoft-entra/) test tenant ([teardown](https://startwithidentity.com/breaches/midnight-blizzard-2024-microsoft/)).

Do not read the collapse in "not enforced", from 12 of 39 in 2023-2024 to 1 of 43 in 2025-2026, as proof that the gaps closed. It is probably partly that, since the Snowflake campaign made MFA enforcement on SaaS tenants a priority, and partly disclosure: 17 of the 43 newest records do not yet say whether MFA was present.

## Finding 3: the MFA blind zone

**Definition: MFA blind zone.** The share of incidents in which the abused path had no interactive login at which MFA could have applied: a service account, API key, token or OAuth app, or a flaw that skips the login step entirely. In database terms, MFA status "not applicable".

| MFA blind zone | 2021-2022 | 2023-2024 | 2025-2026 |
|---|---|---|---|
| Incidents | 7 of 33 (21.2%) | 11 of 39 (28.2%) | 20 of 43 (46.5%) |
| ... non-human identity | 5 | 9 | 12 |
| ... human account, but the flaw skipped login | 2 | 2 | 8 |

Across the whole period the blind zone holds 38 of 115 incidents (33.0%), more than either bypassed or missing MFA. The 2025-2026 growth comes from two directions. Machine identities: npm worms ([Shai-Hulud](https://startwithidentity.com/breaches/incidents/2025-shai-hulud-npm-worm/) and its [second wave](https://startwithidentity.com/breaches/incidents/2025-shai-hulud-2-npm-worm/)), the [tj-actions](https://startwithidentity.com/breaches/incidents/2025-tj-actions-changed-files-ci-secrets/) GitHub Action, [Salesloft Drift](https://startwithidentity.com/breaches/incidents/2025-salesloft-drift-oauth-token-theft/) and [Gainsight](https://startwithidentity.com/breaches/incidents/2025-gainsight-salesforce-token-abuse/) OAuth tokens, [JadePuffer's](https://startwithidentity.com/breaches/incidents/2026-jadepuffer-azure-service-principals/) service principals. And appliance flaws that hand out an authenticated session without a login: [FortiWeb](https://startwithidentity.com/breaches/incidents/2025-fortiweb-cve-2025-64446-admin-creation/), FortiCloud SSO [before](https://startwithidentity.com/breaches/incidents/2025-fortigate-forticloud-sso-saml-bypass/) and [after](https://startwithidentity.com/breaches/incidents/2026-forticloud-sso-bypass-on-patched-fortigates/) the patch, [N-able N-central](https://startwithidentity.com/breaches/incidents/2026-n-able-n-central-auth-bypass/), [Ivanti Connect Secure](https://startwithidentity.com/breaches/incidents/2026-ivanti-connect-secure-uta0576/) and [BeyondTrust](https://startwithidentity.com/vendors/pam/beyondtrust/) [Remote Support](https://startwithidentity.com/breaches/incidents/2026-beyondtrust-remote-support-armory-castle/).

The practical point: an MFA rollout, however good, cannot reach almost half of the newest breaches. Those need short-lived machine credentials, token binding, and patch speed on the identity edge.

## Finding 4: non-human identities, a quarter of breaches and rising

| Non-human identity was the abused identity | 2021-2022 | 2023-2024 | 2025-2026 | All |
|---|---|---|---|---|
| Incidents | 5 of 33 (15.2%) | 10 of 39 (25.6%) | 14 of 43 (32.6%) | 29 of 115 (25.2%) |

How the 29 non-human incidents began: exposed secrets (8), software supply chain (6), stolen credentials (5), OAuth token abuse (4), third-party access (3), consent phishing (2) and password spraying (1). The failed control was recorded as non-human identity in 21, credential storage in 4, authorization in 2 and session and tokens in 2. Nation-state actors lean hardest on machine identities: **7 of the 15 nation-state incidents (46.7%) abused a non-human identity**, from Nobelium's service principal abuse at [Malwarebytes](https://startwithidentity.com/breaches/incidents/2021-malwarebytes-service-principal-abuse/) and the [Mimecast certificate](https://startwithidentity.com/breaches/incidents/2021-mimecast-certificate-compromise/) to the [Treasury intrusion through a BeyondTrust API key](https://startwithidentity.com/breaches/incidents/2024-us-treasury-beyondtrust-api-key/) and [Storm-0940's use of ConnectWise app identities](https://startwithidentity.com/breaches/incidents/2026-connectwise-cloud-backup-app-credential/).

The secrets were rarely hidden well. [Microsoft AI researchers](https://startwithidentity.com/breaches/incidents/2023-microsoft-ai-research-sas-token-exposure/) published a SAS token with full control of a storage account. [Zeabur](https://startwithidentity.com/breaches/incidents/2026-zeabur-plaintext-admin-token/) kept a non-expiring shared-cluster admin token in plaintext in a private repository. [LiteLLM's](https://startwithidentity.com/breaches/incidents/2026-litellm-leaked-admin-key-poisoned-release/) admin key was committed to a public repository, deleted, and never revoked. [TeamFiltration](https://startwithidentity.com/breaches/incidents/2026-teamfiltration-chile-service-accounts/) spraying against 28 Chilean Microsoft 365 tenants compromised seven accounts, all functional or service accounts with no MFA and default or never-rotated passwords.

Non-human breaches are also harder to size. **26 of the 29 have no count of affected people or records**, because the loss is secrets, source code or downstream access, not a customer table. A breach register that ranks incidents by records affected will systematically under-weight them.

AI shows up in four 2025-2026 records, and in none of them is an AI agent the abused identity. Twice it was the attacker's tooling (JadePuffer's agent toolchain deleting storage accounts within seven minutes, and Storm-0940's ARTEX framework), and twice it was the route to a developer's secrets ([Nx](https://startwithidentity.com/breaches/incidents/2025-nx-s1ngularity-npm-compromise/) prompting installed AI command-line tools to hunt for credentials, and a [hijacked AI coding assistant session](https://startwithidentity.com/breaches/incidents/2026-saas-provider-ai-coding-assistant-shai-hulud/)). The standards that would let an agent carry its own scoped, revocable identity are mapped in the companion [Agent Identity Standards Map 2026](https://startwithidentity.com/reports/agent-identity-standards-map-2026/).

## Finding 5: fan-out breaches

**Definition: fan-out breach.** An incident in which one compromised identity or credential store at a provider (a support account, an integration's OAuth tokens, an app secret, a CI credential, a package publisher token) is used, or exposed for use, against many separate customer organizations. The **fan-out** is the number of downstream organizations, tenants or repositories reached.

19 of 115 incidents (16.5%) are fan-out breaches: 6 of 33 in 2021-2022, 3 of 39 in 2023-2024 and **10 of 43 (23.3%) in 2025-2026**. 14 of the 19 abused a non-human identity.

| Fan-out breach | Disclosed | One compromise | Downstream reach, per the record |
|---|---|---|---|
| [Mimecast](https://startwithidentity.com/breaches/incidents/2021-mimecast-certificate-compromise/) | 2021 | Microsoft 365 app certificate | Not published |
| [Codecov](https://startwithidentity.com/breaches/incidents/2021-codecov-bash-uploader/) | 2021 | Cloud storage credential, then customer CI secrets | Not published |
| [Nobelium delegated admin](https://startwithidentity.com/breaches/incidents/2021-nobelium-delegated-admin-privileges/) | 2021 | Reseller delegated admin privileges | 609 customers attacked through 14 compromised providers |
| [Okta via Sitel](https://startwithidentity.com/breaches/incidents/2022-okta-sitel-lapsus/) | 2022 | One support engineer workstation | 2 tenants accessed, 366 potentially affected |
| [GitHub, Heroku and Travis CI](https://startwithidentity.com/breaches/incidents/2022-github-heroku-travis-oauth-tokens/) | 2022 | Machine account token, then integration OAuth tokens | Dozens of organizations |
| [Twilio](https://startwithidentity.com/breaches/incidents/2022-twilio-sms-phishing/) | 2022 | Employee access to internal customer tools | 209 customers and 93 Authy users |
| [CircleCI](https://startwithidentity.com/breaches/incidents/2023-circleci-engineer-session-token-theft/) | 2023 | One engineer's session | Every customer told to rotate all secrets |
| [Okta support system](https://startwithidentity.com/breaches/incidents/2023-okta-support-system-har-session-tokens/) | 2023 | Service account into the support case system | 134 customers, sessions hijacked at 5 |
| [Sisense](https://startwithidentity.com/breaches/incidents/2024-sisense-gitlab-token-customer-credentials/) | 2024 | Hard-coded token to customer credentials | Not published |
| [tj-actions/changed-files](https://startwithidentity.com/breaches/incidents/2025-tj-actions-changed-files-ci-secrets/) | 2025 | One Action's version tags | Not published |
| [Commvault Metallic](https://startwithidentity.com/breaches/incidents/2025-commvault-metallic-azure-app-secrets/) | 2025 | App client secrets for a backup SaaS | A small number of customers |
| [Salesloft Drift](https://startwithidentity.com/breaches/incidents/2025-salesloft-drift-oauth-token-theft/) | 2025 | One integration's OAuth tokens | Numerous Salesforce instances |
| [Gainsight](https://startwithidentity.com/breaches/incidents/2025-gainsight-salesforce-token-abuse/) | 2025 | One publisher's connected apps | More than 200 potentially affected instances |
| [Nx (s1ngularity)](https://startwithidentity.com/breaches/incidents/2025-nx-s1ngularity-npm-compromise/) | 2025 | One CI workflow open to injection | Over a thousand valid GitHub tokens leaked |
| [Shai-Hulud](https://startwithidentity.com/breaches/incidents/2025-shai-hulud-npm-worm/) | 2025 | Stolen npm tokens republishing packages | More than 500 packages |
| [Shai-Hulud, second wave](https://startwithidentity.com/breaches/incidents/2025-shai-hulud-2-npm-worm/) | 2025 | Same worm | Over 25,000 repositories with leaked secrets |
| [Mixpanel](https://startwithidentity.com/breaches/incidents/2025-mixpanel-smishing-openai-api-users/) | 2025 | Analytics vendor employee access | A limited number of customers, including OpenAI |
| [ConnectWise Cloud Backup](https://startwithidentity.com/breaches/incidents/2026-connectwise-cloud-backup-app-credential/) | 2026 | One vendor app credential | 162 tenants confirmed, more than 2,250 attempted |
| [LiteLLM](https://startwithidentity.com/breaches/incidents/2026-litellm-leaked-admin-key-poisoned-release/) | 2026 | One leaked admin key | Not published (poisoned release live about two hours) |

Fan-out also creates records of its own. Eight incidents in the database exist because another record's compromise reached them: [Signal](https://startwithidentity.com/breaches/incidents/2022-signal-twilio-registration/) through [Twilio](https://startwithidentity.com/vendors/mfa/twilio-verify/), [DoorDash](https://startwithidentity.com/breaches/incidents/2022-doordash-vendor-phishing/) through the 0ktapus campaign, [Cloudflare](https://startwithidentity.com/breaches/incidents/2024-cloudflare-unrotated-okta-breach-credentials/) through the Okta support breach, four Snowflake customers, and Gainsight through tokens reporting ties to Salesloft Drift. The [Okta support breach](https://startwithidentity.com/breaches/okta-2023-support-system-breach/) shows how the second hop happens: [Cloudflare](https://startwithidentity.com/vendors/zero-trust/cloudflare/) contained the October 2023 session hijack, then missed one access token and three service account credentials from it, which an attacker Cloudflare believes was a nation state used a month later. Cloudflare rotated more than 5,000 production credentials afterward.

**Snowflake is not a fan-out breach.** Mandiant found no compromise of Snowflake's platform. UNC5537 logged into about 165 customer accounts one by one with infostealer credentials, some from 2020, on accounts with no MFA ([teardown](https://startwithidentity.com/breaches/snowflake-2024-credential-attacks/)). That is a shared-platform campaign: many separate compromises, one technique, one platform. The difference matters for the fix. A fan-out breach is the provider's identity problem and needs the provider to scope, rotate and revoke. A platform campaign is each customer's identity problem and needs each tenant to enforce MFA and network restrictions. The database records six such campaigns, including Snowflake, UNC6040 against Salesforce customers, [0ktapus](https://startwithidentity.com/breaches/incidents/2022-0ktapus-phishing-campaign/) against more than 130 organizations, and the [Microsoft 365 token replay](https://startwithidentity.com/breaches/incidents/2026-microsoft-365-token-replay-79-orgs/) into 79 organizations.

## Which identity control failed

| Failed identity control | All (115) | 2021-2022 (33) | 2023-2024 (39) | 2025-2026 (43) |
|---|---|---|---|---|
| [Authentication](https://startwithidentity.com/techniques/authentication/) | 51 (44.3%) | 16 (48.5%) | 17 (43.6%) | 18 (41.9%) |
| [Non-human identity](https://startwithidentity.com/techniques/non-human-identity/) | 21 (18.3%) | 5 (15.2%) | 5 (12.8%) | 11 (25.6%) |
| [Session and tokens](https://startwithidentity.com/techniques/session-and-tokens/) | 12 (10.4%) | 3 (9.1%) | 5 (12.8%) | 4 (9.3%) |
| [Credential storage](https://startwithidentity.com/techniques/credential-storage/) | 10 (8.7%) | 1 (3.0%) | 5 (12.8%) | 4 (9.3%) |
| [Authorization](https://startwithidentity.com/techniques/authorization/) | 9 (7.8%) | 6 (18.2%) | 1 (2.6%) | 2 (4.7%) |
| [Identity lifecycle](https://startwithidentity.com/techniques/identity-lifecycle/) | 9 (7.8%) | 2 (6.1%) | 5 (12.8%) | 2 (4.7%) |
| [Directory and trust](https://startwithidentity.com/techniques/directory-and-trust/) | 3 (2.6%) | 0 | 1 (2.6%) | 2 (4.7%) |

Authentication is the failed control in a steady four in ten incidents. Non-human identity is the one that moved, from 5 of 39 in 2023-2024 to 11 of 43 in 2025-2026. The techniques recorded most often across the database are [secrets in repositories and CI](https://startwithidentity.com/techniques/secrets-in-repositories-and-ci/) (14 incidents), [infostealer credential harvesting](https://startwithidentity.com/techniques/infostealer-credential-harvesting/) (10), [credential stuffing](https://startwithidentity.com/techniques/credential-stuffing/) (8), [static API key abuse](https://startwithidentity.com/techniques/static-api-key-abuse/) (8) and [session cookie theft](https://startwithidentity.com/techniques/session-cookie-theft/) (7).

## Who did it

| Actor type | All (115) | 2021-2022 (33) | 2023-2024 (39) | 2025-2026 (43) |
|---|---|---|---|---|
| Unattributed | 48 (41.7%) | 8 (24.2%) | 13 (33.3%) | 27 (62.8%) |
| Financially motivated | 30 (26.1%) | 11 (33.3%) | 14 (35.9%) | 5 (11.6%) |
| Extortion group | 19 (16.5%) | 7 (21.2%) | 5 (12.8%) | 7 (16.3%) |
| Nation-state | 15 (13.0%) | 5 (15.2%) | 6 (15.4%) | 4 (9.3%) |
| Insider | 2 (1.7%) | 2 (6.1%) | 0 | 0 |
| Researcher (discovered, no attack) | 1 (0.9%) | 0 | 1 (2.6%) | 0 |

46 of 115 records (40%) name an actor, and only 15 of 43 in 2025-2026 do. Attribution lags disclosure, so the unattributed share of recent incidents will fall as reports come in. Named actors, counted only from the actor field as the victim or a named security firm attributed it:

| Actor cluster | Records | Periods | How they got in |
|---|---|---|---|
| Scattered Spider and 0ktapus (UNC3944, Scatter Swine) | 8 | 4, 3, 1 | Help desk social engineering 4, credential phishing 2, third-party access 2 |
| Midnight Blizzard, Nobelium, APT29 | 6 | 4, 2, 0 | Password spraying 2, OAuth token abuse, stolen credentials, supply chain, third-party access |
| LAPSUS$ (DEV-0537) | 5 | 5, 0, 0 | MFA fatigue 2, stolen credentials 2, third-party access 1 |
| ShinyHunters and UNC6040 | 4 | 0, 1, 3 | Consent phishing, OAuth token abuse, credential phishing, an unauthenticated endpoint |
| China-nexus (Storm-0558, Storm-0940, Armory Castle, the Treasury intruder) | 4 | 0, 2, 2 | Identity infrastructure 2, third-party access 2 |
| North Korea (Lazarus Group, TraderTraitor) | 2 | 1, 0, 1 | Stolen validator keys, a hijacked AWS session |

Attributions in three of the Scattered Spider records and three of the ShinyHunters records are hedged in the source ("claimed", "linked", "widely linked"), and the record says so. Marks & Spencer, for example, is claimed by DragonForce and widely linked to Scattered Spider. The pattern across clusters is consistent with the talk-past shift. LAPSUS$ in 2022 used push spam and bought credentials. Scattered Spider in 2023 called help desks. The ShinyHunters-linked activity in 2025-2026 used vishing to get OAuth consent and then reused the tokens. Each generation found a step that MFA did not guard.

## Which industries

| Industry | All (115) | 2021-2022 (33) | 2023-2024 (39) | 2025-2026 (43) |
|---|---|---|---|---|
| Technology | 40 (34.8%) | 14 (42.4%) | 11 (28.2%) | 15 (34.9%) |
| [B2B SaaS](https://startwithidentity.com/verticals/b2b-saas/) | 19 (16.5%) | 4 (12.1%) | 7 (17.9%) | 8 (18.6%) |
| Cross-industry campaigns | 13 (11.3%) | 4 (12.1%) | 2 (5.1%) | 7 (16.3%) |
| [Retail and e-commerce](https://startwithidentity.com/verticals/retail-ecommerce/) | 8 (7.0%) | 1 (3.0%) | 3 (7.7%) | 4 (9.3%) |
| [Media and streaming](https://startwithidentity.com/verticals/media-streaming/) | 6 (5.2%) | 0 | 5 (12.8%) | 1 (2.3%) |
| [Crypto and Web3](https://startwithidentity.com/verticals/crypto-web3/) | 5 (4.3%) | 3 (9.1%) | 0 | 2 (4.7%) |
| [Telecom](https://startwithidentity.com/verticals/telecom/) | 4 (3.5%) | 2 (6.1%) | 2 (5.1%) | 0 |
| [Financial services](https://startwithidentity.com/verticals/financial-services/), [gaming](https://startwithidentity.com/verticals/gaming/), [government](https://startwithidentity.com/verticals/government/), [healthcare](https://startwithidentity.com/verticals/healthcare/), [insurance](https://startwithidentity.com/verticals/insurance/) | 3 each | | | |
| [Education](https://startwithidentity.com/verticals/education/), [manufacturing](https://startwithidentity.com/verticals/manufacturing/) | 2 each | | | |
| [Energy and utilities](https://startwithidentity.com/verticals/energy-utilities/) | 1 | 1 | 0 | 0 |

Technology and B2B SaaS companies are 59 of 115 incidents (51.3%). Some of that is real (they hold the tokens and integrations that fan-out breaches use) and some is selection: technology companies publish root-cause reports more often than retailers or hospitals do, which makes their incidents easier to classify. The media and streaming spike in 2023-2024 is five unrelated incidents: [Reddit](https://startwithidentity.com/breaches/incidents/2023-reddit-employee-phishing/) phishing, Ticketmaster in the Snowflake campaign, credential stuffing at Roku, an infostealer at [Disney](https://startwithidentity.com/breaches/incidents/2024-disney-slack-employee-infostealer/) and an exposed token at the [New York Times](https://startwithidentity.com/breaches/incidents/2024-new-york-times-exposed-github-token/).

## Finding 6: records affected are concentrated, and missing MFA holds most of them

34 of 115 records (29.6%) carry a number in the records-affected field: 14 in 2021-2022, 14 in 2023-2024 and 6 in 2025-2026. Ten of those count organizations, business accounts or credential sets rather than people (for example 134 Okta customers, or 9,931 credential sets captured by 0ktapus), so we set them aside. That leaves **24 incidents that count people or consumer accounts**.

| Largest counts of people or consumer accounts | Disclosed | Count | MFA |
|---|---|---|---|
| [Change Healthcare](https://startwithidentity.com/breaches/incidents/2024-change-healthcare-citrix-no-mfa/) | 2024 | 192.7 million | Not enforced |
| [AT&T (Snowflake)](https://startwithidentity.com/breaches/incidents/2024-att-snowflake-call-records/) | 2024 | 110 million | Not enforced |
| [Comcast Xfinity (Citrix Bleed)](https://startwithidentity.com/breaches/incidents/2023-comcast-xfinity-citrix-bleed/) | 2023 | 35.9 million | Bypassed |
| [Internet Archive](https://startwithidentity.com/breaches/incidents/2024-internet-archive-exposed-gitlab-zendesk-tokens/) | 2024 | 31 million | Not applicable |
| [Aflac](https://startwithidentity.com/breaches/incidents/2025-aflac-social-engineering/) | 2025 | 22.65 million | Not disclosed |
| [Medibank](https://startwithidentity.com/breaches/incidents/2022-medibank-contractor-credentials-vpn/) | 2022 | 9.7 million | Not enforced |
| [Optus](https://startwithidentity.com/breaches/incidents/2022-optus-unauthenticated-api/) | 2022 | 9.5 million | Not applicable |
| [Denmark CPR register](https://startwithidentity.com/breaches/incidents/2026-denmark-cpr-register-access-abuse/) | 2026 | 8.8 million | Not disclosed |
| [Cash App](https://startwithidentity.com/breaches/incidents/2022-cash-app-former-employee/) | 2022 | 8.2 million | Not disclosed |
| [Robinhood](https://startwithidentity.com/breaches/incidents/2021-robinhood-support-vishing/) | 2021 | 7 million | Not disclosed |

The 24 counts add up to **445.8 million notifications**. That is not a count of people: the same person can appear in several breaches, and some counts are accounts. Read it as the size of the notification burden these incidents created. The median incident is much smaller, about 1.45 million, and 12 of the 24 reached a million. Two incidents, Change Healthcare and AT&T, are 67.9% of the total.

**The 10 incidents where MFA was absent on the abused account hold 322.4 million of those notifications (72.3%)**. The 3 with MFA bypassed hold 35.9 million, almost all of it Comcast. The causal claim is narrow but hard to escape: the largest identity breaches of the period mostly began with a password that worked on its own.

## Finding 7: what the disclosed costs show

Only **10 of 115 incidents (8.7%) carry a disclosed dollar figure** in US dollars. Six more have a cost note but no USD figure: five give a number we did not convert or that is a range or a claim ([LastPass](https://startwithidentity.com/vendors/password-management/lastpass/), Medibank, Clorox, Marks & Spencer, and Coinbase's 2025 estimate of $180 million to $400 million), and Caesars disclosed none. The ten figures measure four different things, so we never add them across types:

| Incident | Figure | What it is |
|---|---|---|
| [Change Healthcare](https://startwithidentity.com/breaches/incidents/2024-change-healthcare-citrix-no-mfa/) | $3.067 billion | Company-reported cost, 2024 only (UnitedHealth 10-K) |
| [Bybit through Safe{Wallet}](https://startwithidentity.com/breaches/incidents/2025-bybit-safe-wallet-aws-session-hijack/) | $1.5 billion | Value stolen |
| [Ronin bridge](https://startwithidentity.com/breaches/incidents/2022-ronin-bridge-validator-keys/) | $620 million | Value stolen |
| [MGM Resorts](https://startwithidentity.com/breaches/incidents/2023-mgm-resorts-help-desk-ransomware/) | $100 million | Company-reported cost (EBITDAR impact, 8-K) |
| [Crypto.com](https://startwithidentity.com/breaches/incidents/2022-crypto-com-2fa-bypass/) | $34 million | Value stolen, customers reimbursed |
| [Cash App](https://startwithidentity.com/breaches/incidents/2022-cash-app-former-employee/) | $15 million | Class action settlement |
| [Colonial Pipeline](https://startwithidentity.com/breaches/incidents/2021-colonial-pipeline-legacy-vpn/) | $4.4 million | Ransom paid |
| [Advance Auto Parts](https://startwithidentity.com/breaches/incidents/2024-advance-auto-parts-snowflake-account/) | $3 million | Company-reported cost for one quarter |
| [Verkada](https://startwithidentity.com/breaches/incidents/2021-verkada-super-admin-credentials/) | $2.95 million | Civil penalty (for CAN-SPAM violations, in a settlement that also imposed a security program) |
| [PayPal](https://startwithidentity.com/breaches/incidents/2023-paypal-credential-stuffing/) | $2 million | Civil penalty (New York DFS) |

| Type | Incidents | Total |
|---|---|---|
| Company-reported cost | 3 | $3.17 billion |
| Value stolen | 3 | $2.154 billion |
| Penalty or settlement | 3 | $19.95 million |
| Ransom paid | 1 | $4.4 million |

Change Healthcare is 96.8% of company-reported cost, and its figure covers 2024 only. Two of the three company-reported costs follow logins without MFA (Change Healthcare and Advance Auto Parts) and the third, MGM, a help desk reset. The value-stolen rows are all crypto, and two of the three are North Korean operations that went through identities rather than code: five of nine validator keys at Ronin, and a developer's hijacked AWS session at Safe{Wallet}. Across the records that carry a figure, penalties and settlements total $19.95 million against $3.17 billion in company-reported cost. On this evidence the breach itself, not the regulatory response, is where the money goes.

## Finding 8: regulatory outcomes lag, and missing MFA draws them

**20 of 115 incidents (17.4%) have a recorded regulatory or legal outcome**: 9 of 33 from 2021-2022, 11 of 39 from 2023-2024 and none of the 43 from 2025-2026. The newest period is not cleaner. The median outcome in the records arrives two years after disclosure (measured as the latest year named in the outcome minus the disclosure year), and 12 of the 20 took two years or more.

| Outcome type (one incident can have several) | Incidents |
|---|---|
| Government directive, alert or review | 7 |
| Criminal charges, plea, sentence or sanctions | 6 |
| Fine or civil penalty imposed | 4 |
| Settlement (regulator or class action) | 3 |
| Regulator or civil proceedings, pending | 3 |

The four fines are [LastPass](https://startwithidentity.com/breaches/incidents/2022-lastpass-vault-backup-theft/) (UK ICO, GBP 1.2 million), [23andMe](https://startwithidentity.com/breaches/incidents/2023-23andme-credential-stuffing-dna-relatives/) (UK ICO, GBP 2.31 million), PayPal (New York DFS, $2 million) and Verkada (FTC and DOJ, $2.95 million). Two of the four, 23andMe and PayPal, cite the lack of required MFA in the regulator's own finding, and both followed credential stuffing.

That pattern holds across the set. **Incidents with MFA absent drew an outcome in 6 of 15 cases (40%)**, against 5 of 25 (20%) with MFA bypassed and 9 of 75 (12%) where MFA was unknown or not applicable. Small numbers, and regulators act on harm and on the victim's jurisdiction as much as on controls. But a missing control is easy to cite, and regulators are citing it. CISA's directives cover the other end: [ED 21-03](https://startwithidentity.com/breaches/incidents/2021-pulse-connect-secure-exploitation/) for Pulse Connect Secure and ED 24-02 for the email Midnight Blizzard took from Microsoft. The [Cyber Safety Review Board](https://startwithidentity.com/breaches/incidents/2023-storm-0558-microsoft-signing-key-forgery/) called Storm-0558's forged-token intrusion preventable.

## Credentials that should already have been dead

One more pattern cuts across the vectors. In **12 of 115 incidents (10.4%)** the abused credential or access should have been revoked, rotated or expired before the attack: it belonged to a former employee or a retired system, it had been exposed in an earlier incident, or it was deleted from view but never revoked. The count is steady across periods (3, 4 and 5). Examples: Colonial's legacy VPN profile, a [former Cash App employee's](https://startwithidentity.com/breaches/incidents/2022-cash-app-former-employee/) report access, the Ronin validator allowlist never revoked, Microsoft's legacy test tenant, Cloudflare's unrotated Okta-breach credentials, Snowflake credentials stolen as early as 2020, the Internet Archive's unrotated Zendesk tokens, [PowerSchool's](https://startwithidentity.com/breaches/incidents/2025-powerschool-powersource-credential/) reused support-portal credential, Gainsight tokens tied to the earlier Drift theft, a [departing CrowdSec engineer's](https://startwithidentity.com/breaches/incidents/2026-crowdsec-departing-engineer-github-token/) GitHub token, LiteLLM's deleted-but-valid key, and [GhostAction](https://startwithidentity.com/breaches/incidents/2026-ghostaction-github-actions-secrets-wave/) victims who never rotated after the 2025 wave. None of these needed a new technique. They needed an old credential to still work.

## The ten identity controls that would have changed the most outcomes

Each control below is tied to the incidents in the database it addresses, by a rule on the record fields published in the statistics file. A control "addresses" an incident when the incident's recorded access path is the one the control closes. Most incidents are addressed by more than one control (median two), so the counts overlap and do not add to 115. Together the ten address **108 of 115 incidents (93.9%)**, and the top three alone address 77 (67%). The seven left over are insiders, Optus's unauthenticated API, and four stolen-credential cases where the records do not say how the password was obtained or whether MFA was on.

| Rank | Control | Incidents addressed (of 115) | 2021-2022 | 2023-2024 | 2025-2026 |
|---|---|---|---|---|---|
| 1 | Phishing-resistant MFA on every human login | 40 (34.8%) | 12 | 15 | 13 |
| 2 | Non-human identity inventory, short-lived credentials, no secrets in code or CI | 30 (26.1%) | 6 | 10 | 14 |
| 3 | Brokered, time-bound third-party and integration access | 24 (20.9%) | 8 | 5 | 11 |
| 4 | Bound, short-lived sessions and tokens, revoked on reset | 18 (15.7%) | 6 | 5 | 7 |
| 5 | Treat an infostealer infection as an identity compromise | 17 (14.8%) | 5 | 10 | 2 |
| 6 | Kill credentials on departure, retirement and every upstream breach | 17 (14.8%) | 3 | 8 | 6 |
| 7 | Run the identity edge (VPNs, SSO appliances, remote support) as tier zero | 16 (13.9%) | 3 | 5 | 8 |
| 8 | MFA on every login path, with no exceptions | 15 (13.0%) | 2 | 12 | 1 |
| 9 | Verify callers before any reset, and never approve by phone | 13 (11.3%) | 3 | 5 | 5 |
| 10 | Govern OAuth apps and user consent | 8 (7.0%) | 2 | 2 | 4 |

**1. Phishing-resistant MFA on every human login (40 incidents).** Addresses human-account incidents where the attacker got in by phishing, push spam, SIM swap, stuffing or spraying, or with a stolen password where MFA was absent. [Passkeys](https://startwithidentity.com/glossary/passkey/) and FIDO2 security keys bind the login to the real domain, so a [proxy](https://startwithidentity.com/techniques/aitm-phishing-proxy/), a [code relayed by phone](https://startwithidentity.com/techniques/otp-relay-social-engineering/) or a [push flood](https://startwithidentity.com/techniques/mfa-fatigue-push-bombing/) gets nothing usable. They also make stuffed and sprayed passwords useless on their own. Start with administrators, help desk staff and anyone who can approve an OAuth app. See [phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/), the [enterprise passkeys guide](https://startwithidentity.com/guides/authentication/implementing-passkeys-enterprise/), the [passkey rollout checklist](https://startwithidentity.com/templates/passkey-rollout-checklist/) and the [best phishing-resistant MFA](https://startwithidentity.com/rankings/best-phishing-resistant-mfa/) ranking. It is the top control in 2021-2022 and 2023-2024; in 2025-2026 the non-human control overtakes it, 14 to 13. It would not have stopped the CircleCI session theft or the Cyberhaven consent grant, which is why controls 4 and 10 exist.

**2. An owned inventory of non-human identities, short-lived credentials, and no secrets in code or CI (30 incidents).** Addresses every non-human incident plus every exposed-secret and supply-chain incident. Give every service account, API key, OAuth app and CI token an owner and an expiry. Replace static cloud keys in CI with [workload identity federation](https://startwithidentity.com/glossary/workload-identity-federation/), publish packages with [trusted publishing](https://startwithidentity.com/glossary/trusted-publishing/) rather than long-lived npm or PyPI tokens, and scan repositories and CI logs for [secrets in code](https://startwithidentity.com/techniques/secrets-in-repositories-and-ci/) and [static API keys](https://startwithidentity.com/techniques/static-api-key-abuse/). See the [non-human identity security guide](https://startwithidentity.com/guides/machine-identity/non-human-identity-security/), [API key rotation automation](https://startwithidentity.com/guides/machine-identity/api-key-rotation-automation-guide/), [what is a non-human identity](https://startwithidentity.com/guides/fundamentals/what-is-non-human-identity/) and [secrets rotation](https://startwithidentity.com/glossary/secrets-rotation/). This is the control whose count grew most, from 6 to 14 by period.

**3. Vendor, contractor and integration access through brokered, time-bound, logged paths (24 incidents).** Addresses third-party access incidents and every fan-out breach. Support vendors, outsourced help desks, resellers with delegated admin, and SaaS integrations should reach your systems through [just-in-time](https://startwithidentity.com/glossary/jit-access/), approved, recorded sessions, with no [standing privilege](https://startwithidentity.com/glossary/zero-standing-privileges/). For integrations, restrict connected apps to known IP ranges where the platform allows it, scope tokens to the data the integration needs, and know how to revoke every token for one vendor in one action. See [implementing privileged access management](https://startwithidentity.com/guides/architecture/implementing-privileged-access-management/), the [zero standing privileges rollout](https://startwithidentity.com/guides/implementation/zero-standing-privileges-rollout/) and the [access review checklist](https://startwithidentity.com/templates/access-review-checklist/).

**4. Bound, short-lived sessions and tokens, revoked on reset (18 incidents).** Addresses session and token theft, OAuth token abuse, session-and-token failures, and incidents using [session cookie theft](https://startwithidentity.com/techniques/session-cookie-theft/), [token replay](https://startwithidentity.com/techniques/token-replay-unbound-endpoint/) or [refresh token abuse](https://startwithidentity.com/techniques/refresh-token-abuse/). Use [device-bound session credentials](https://startwithidentity.com/glossary/device-bound-session-credentials/) and token protection where your IdP supports them, [DPoP](https://startwithidentity.com/glossary/dpop/) or [mTLS](https://startwithidentity.com/glossary/mtls/) for API tokens, short session lifetimes for admin roles, and [continuous access evaluation](https://startwithidentity.com/glossary/caep/) so a password reset or risk event ends live sessions. The [Microsoft 365 token replay](https://startwithidentity.com/breaches/incidents/2026-microsoft-365-token-replay-79-orgs/) campaign registered 48 rogue Entra devices and replaced MFA methods so access survived resets. See the [conditional access policies guide](https://startwithidentity.com/guides/implementation/conditional-access-policies-guide/) and [primary refresh token theft](https://startwithidentity.com/techniques/primary-refresh-token-theft/).

**5. Treat an infostealer infection as an identity compromise (17 incidents).** Addresses incidents using [infostealer credential harvesting](https://startwithidentity.com/techniques/infostealer-credential-harvesting/) or session cookie theft. When an [infostealer](https://startwithidentity.com/glossary/infostealer/) hits any device that has held a work login, including a personal laptop, revoke every session for that user, rotate every credential the browser stored, and check for new MFA methods and OAuth grants. Uber, the Snowflake customers, Disney, Nikkei and CircleCI all trace to infostealer malware. See the [infostealer session hijacking teardown](https://startwithidentity.com/breaches/infostealer-session-hijacking/), [pass-the-cookie](https://startwithidentity.com/glossary/pass-the-cookie/), and the [identity incident response runbook](https://startwithidentity.com/templates/identity-incident-response-runbook/).

**6. Kill credentials on departure, retirement and every upstream breach (17 incidents).** Addresses identity-lifecycle failures and the 12 incidents where the credential should already have been dead. [Deprovisioning](https://startwithidentity.com/glossary/deprovisioning/) must reach OAuth tokens and personal access tokens, not just the directory account. Retired systems (legacy VPN profiles, test tenants) must lose their credentials when they lose their purpose. And when a provider you use is breached, rotate everything that provider could have seen, as Cloudflare learned. See the [secure offboarding checklist](https://startwithidentity.com/templates/secure-offboarding-checklist/), the [user lifecycle management guide](https://startwithidentity.com/guides/implementation/user-lifecycle-management-guide/), [orphaned account abuse](https://startwithidentity.com/techniques/orphaned-account-abuse/), [orphaned accounts](https://startwithidentity.com/glossary/orphaned-account/) and [joiner, mover, leaver](https://startwithidentity.com/glossary/joiner-mover-leaver/).

**7. Run the identity edge as tier zero (16 incidents).** Addresses every incident whose initial access was a flaw in identity infrastructure. VPNs, SSO appliances and remote-support tools authenticate users and store credentials, so patch them on identity-system timelines (72 hours for exploited flaws), turn off unused SSO features such as FortiCloud SSO, strip their directory accounts to the minimum, and ship their logs off the box. Ivanti attackers [Kerberoasted](https://startwithidentity.com/techniques/kerberoasting/) from the appliance; [Palo Alto Networks](https://startwithidentity.com/vendors/zero-trust/palo-alto/) GlobalProtect's [auth bypass](https://startwithidentity.com/breaches/incidents/2026-pan-os-globalprotect-auth-bypass-ransomware/) led to domain controller disks. The [Identity Vulnerability Report 2026](https://startwithidentity.com/reports/identity-vulnerability-report-2026/) found 85% of edge and remote-access identity CVEs in its catalog on CISA KEV. See also [SAML forgery](https://startwithidentity.com/techniques/federation-trust-abuse-saml-forgery/), [SimpleHelp's OIDC token forgery](https://startwithidentity.com/cves/cve-2026-48558/) and [what is PAM](https://startwithidentity.com/guides/fundamentals/what-is-pam/).

**8. MFA on every login path, with no exceptions (15 incidents).** Addresses every incident with MFA absent. Several of these organizations used MFA elsewhere; the attacker found the path without it: a legacy VPN profile, a non-production tenant, a remote-access portal, a data warehouse login, a [service account](https://startwithidentity.com/glossary/service-account/) on a default password, or a customer account. Inventory every interactive login path, enforce MFA through [conditional access](https://startwithidentity.com/glossary/conditional-access/) with explicit, logged [break-glass](https://startwithidentity.com/glossary/break-glass/) exceptions, and block legacy protocols that cannot do MFA. For customer accounts, [credential stuffing](https://startwithidentity.com/glossary/credential-stuffing/) defenses and optional passkeys matter as much as for staff. See [MFA implementation best practices](https://startwithidentity.com/guides/authentication/mfa-implementation-best-practices/), the [MFA rollout guide](https://startwithidentity.com/guides/authentication/mfa-rollout/) and [password spraying](https://startwithidentity.com/techniques/password-spraying/).

**9. Verify callers before any reset, and never approve by phone (13 incidents).** Addresses help desk social engineering and voice-led access. The help desk should never reset MFA on a caller's word: require a call back to a number on file, manager approval, or an identity verification step, and apply stricter rules for privileged accounts. Every employee should know that IT will never ask for a code or an app approval by phone. See [help desk social engineering](https://startwithidentity.com/techniques/help-desk-social-engineering/), [vishing](https://startwithidentity.com/glossary/vishing/), [account recovery](https://startwithidentity.com/glossary/account-recovery/), the [Scattered Spider teardown](https://startwithidentity.com/breaches/scattered-spider-helpdesk-social-engineering/) and our analysis of why [the help desk is the perimeter](https://startwithidentity.com/blog/help-desk-is-the-perimeter/).

**10. Govern OAuth apps and user consent (8 incidents).** Addresses OAuth token abuse, consent phishing and refresh token abuse. Restrict which users can authorize third-party apps, require admin approval for high-privilege scopes, allow-list connected apps in Salesforce, Google Workspace and Microsoft 365, and revoke tokens for apps that have gone quiet. UNC6040, Cyberhaven, Salesloft Drift and Gainsight are this control's cases. See [OAuth consent phishing](https://startwithidentity.com/techniques/oauth-consent-phishing/), [device code phishing](https://startwithidentity.com/techniques/device-code-phishing/), [consent phishing](https://startwithidentity.com/glossary/consent-phishing/), [refresh tokens](https://startwithidentity.com/glossary/refresh-token/) and the [OAuth 2.0 and OpenID Connect implementation guide](https://startwithidentity.com/guides/implementation/oauth-2-openid-connect-implementation/). The count is small but rose to 4 of 43 in 2025-2026, and three of those four reached many Salesforce customers at once.

When one of these controls fails anyway, the [identity incident response runbook](https://startwithidentity.com/templates/identity-incident-response-runbook/) covers session revocation, token and secret rotation, and the order to do them in. Several of the 2026 intrusions here were found and documented by outside detection teams (Huntress, [Proofpoint](https://startwithidentity.com/vendors/itdr/proofpoint/), Volexity, Arctic Wolf), which is the case for [ITDR](https://startwithidentity.com/guides/security/identity-threat-detection-response-guide/) coverage of sign-in, token and app-consent events.

## About the data

- **Dataset:** the [Identity Breach Database](https://startwithidentity.com/breaches/incidents/), 115 incidents with one page each, downloadable below as CSV and JSON (full records with sources). The statistics file holds every aggregate in this report, the initial-access families, and each derived list (voice-led incidents, fan-out breaches, downstream records, shared-platform campaigns, credentials that should have been dead, record units and cost types) with a reason per incident.
- **Reproduce it:** `node scripts/reports/identity-breach-report.mjs` in the site repository prints every figure in this report and rewrites the statistics file. `node scripts/verify-identity-breaches.mjs` validates every record against the schema, and `scripts/reports/identity-breach-export.mjs` writes the CSV and JSON.
- **Corrections made for this report:** Twilio's two records (the [2022 SMS phishing](https://startwithidentity.com/breaches/incidents/2022-twilio-sms-phishing/) and the [2024 Authy endpoint](https://startwithidentity.com/breaches/incidents/2024-twilio-authy-unauthenticated-endpoint/)) were classified under different industries, telecom and technology. Both are now B2B SaaS, matching other cloud communications vendors in the set.
- **Limits:** a curated set biased toward disclosed, investigated and well-reported incidents in English; MFA status unknown for 37 records; 2025-2026 records are younger, so attribution, victim counts and regulatory outcomes are less complete; records-affected units vary and are not deduplicated people; dollar figures are of four different types and only 10 records have one; some campaigns appear as several victim records.
- **License:** CC BY 4.0. Cite as "Start with Identity, Identity Breach Report 2026" with a link to this page. Each key finding has a stable anchor (for example `#finding-3`).
- **Corrections and missing incidents:** if a classification looks wrong or an identity breach is missing, tell us through the [contact page](https://startwithidentity.com/contact/). We will update the record, re-run the numbers and date the change.