Skip to content
HACKTECH

Library / Breach Archives

How real breaches actually unfolded.

Each breakdown follows one incident from the initial flaw to the data leaving the building, mapped to MITRE ATT&CK. The point is never the headline — it is the ordinary conditions that turned one mistake into a catastrophe.

Patterns that repeat

  • 4×

    Missing MFA on remote access

    Colonial Pipeline, Snowflake tenants, Change Healthcare and Okta all trace back to authentication that a stolen password alone could satisfy.

  • 3×

    Over-permissioned identity

    Capital One, SolarWinds and Okta each turned a limited foothold into a large breach because the compromised identity could reach far more than its function required.

  • 3×

    Flat internal networking

    Equifax, Colonial Pipeline and Change Healthcare all allowed movement from an initial foothold to sensitive systems without crossing a meaningful boundary.

  • 4×

    Detection deployed but not working

    An expired certificate, an unmonitored management tool, nine days of staging. The control existed on the architecture diagram in every case.

  • 3×

    Third-party concentration

    MOVEit, SolarWinds and Change Healthcare show that your risk includes every vendor holding or touching your data.

Equifax · 2017 · Credit reporting

~147 million individuals

Unpatched internet-facing application (CVE-2017-5638, Apache Struts)

A known, publicly disclosed Struts deserialization flaw remained unpatched on an internet-facing dispute portal for roughly two months after a fix was available. Attackers used it to gain a foothold, then moved through the network largely undetected for 76 days. An expired certificate on a traffic-inspection device meant the exfiltration traffic went unexamined for months.

The chain

  1. 01Exploitation of an unpatched public-facing application
  2. 02Discovery of unencrypted credentials stored on the compromised host
  3. 03Lateral movement into databases that shared no network segmentation boundary
  4. 04Staged exfiltration over encrypted channels that inspection tooling could not read

T1190 Exploit Public-Facing ApplicationT1552.001 Credentials In FilesT1210 Exploitation of Remote ServicesT1041 Exfiltration Over C2 Channel

The lesson

The initial vulnerability was ordinary and the patch existed. What turned it into one of the largest breaches on record was flat internal networking, credentials in plaintext on disk, and a monitoring control that had silently failed and that nobody noticed.

What we test for

Whether a single compromised web host actually reaches your data stores, and whether your inspection and alerting controls are functioning rather than merely deployed.

Capital One · 2019 · Banking

~100 million US and 6 million Canadian applicants

SSRF against a cloud workload with an over-permissioned instance role

A misconfigured web application firewall allowed a server-side request forgery attack to reach the AWS instance metadata service. The credentials returned belonged to a role with far broader S3 permissions than the workload needed, and were used to list and copy more than 700 buckets.

The chain

  1. 01SSRF through a misconfigured WAF reaching the EC2 metadata endpoint
  2. 02Retrieval of temporary IAM credentials from the instance role
  3. 03Enumeration of S3 buckets far beyond the application's own scope
  4. 04Bulk copy of customer data using the harvested credentials

T1190 Exploit Public-Facing ApplicationT1552.005 Cloud Instance Metadata APIT1580 Cloud Infrastructure DiscoveryT1530 Data from Cloud Storage

The lesson

This is the canonical demonstration that cloud breaches are identity breaches. A medium-severity SSRF became a catastrophic incident purely because of what the instance role was permitted to do.

What we test for

SSRF reachability to metadata endpoints, IMDSv2 enforcement, and the real blast radius of every workload identity in the account.

SolarWinds Orion · 2020 · IT management software

~18,000 organisations received the trojanised update

Build pipeline compromise inserting a backdoor into signed releases

Attackers compromised the software build environment and injected a backdoor into Orion updates, which were then signed with legitimate certificates and distributed through the normal update channel. The implant lay dormant for up to two weeks and performed extensive checks for analysis environments before activating.

The chain

  1. 01Compromise of the build environment and insertion of malicious code at compile time
  2. 02Legitimate code-signing of the trojanised artefact
  3. 03Distribution through the vendor's trusted update mechanism
  4. 04Dormancy and environment checks before selective activation against chosen targets

T1195.002 Compromise Software Supply ChainT1553.002 Code SigningT1497 Virtualization/Sandbox EvasionT1078.004 Cloud Accounts

The lesson

Signed does not mean trustworthy — it means the signing key was used. Trust in a vendor's pipeline is transitive, and almost nobody monitors what their management software does on the network once installed.

What we test for

Build pipeline integrity, artefact provenance, and whether your monitoring would notice trusted management software behaving unusually.

Colonial Pipeline · 2021 · Energy infrastructure

Fuel supply disruption across the US East Coast

Legacy VPN account without MFA, credential found in a breach corpus

A single VPN account that was no longer in active use, but had never been disabled, was accessed with a password that appeared in a prior breach dataset. The account had no multi-factor authentication. The operator shut down pipeline operations precautionarily because it could not establish whether operational technology systems had been affected.

The chain

  1. 01Valid credentials for a dormant VPN account obtained from a prior breach corpus
  2. 02Authentication with no second factor required
  3. 03Access to the IT network with insufficient separation from operational visibility
  4. 04Ransomware deployment and precautionary shutdown of pipeline operations

T1078 Valid AccountsT1133 External Remote ServicesT1486 Data Encrypted for Impact

The lesson

The most consequential infrastructure incident of its year required no exploit at all. One forgotten account, one reused password, no MFA. Account lifecycle management is unglamorous and it is the control that would have prevented this.

What we test for

Dormant and orphaned accounts, MFA coverage gaps on every remote access path, and credential reuse against public breach corpora.

Okta support system · 2023 · Identity provider

All customers with active support cases in the affected window

Service account credential saved to a personal Google profile in a browser

An employee signed into a personal Google account in Chrome on a managed device and saved a service account credential to it. That credential was later used to access the customer support case management system, where session tokens embedded in customer-uploaded HAR files were exposed — allowing session hijacking against downstream customers.

The chain

  1. 01Service account credential saved into a personal browser profile
  2. 02Credential compromise outside the corporate identity boundary
  3. 03Access to the support case management system
  4. 04Extraction of session tokens from customer-uploaded HAR files

T1555.003 Credentials from Web BrowsersT1078.004 Cloud AccountsT1539 Steal Web Session Cookie

The lesson

Two failures compound here: a service credential leaving the managed boundary, and a support process that accepted files known to contain live session tokens without sanitising them. The second is far more common than anyone admits.

What we test for

Whether service credentials can leave managed devices, and whether support and logging pipelines are stripping secrets from customer-supplied artefacts.

MOVEit Transfer (Progress Software) · 2023 · Managed file transfer

2,700+ organisations, tens of millions of individuals

Zero-day SQL injection in a widely deployed file transfer product

A SQL injection vulnerability in MOVEit Transfer was exploited at scale before a patch existed, allowing web shell deployment and bulk theft of files. Because the product sits by design at the point where organisations exchange their most sensitive data, a single vendor vulnerability cascaded across thousands of downstream organisations and their customers.

The chain

  1. 01SQL injection against the internet-facing transfer application
  2. 02Web shell deployment for persistent access
  3. 03Enumeration and bulk retrieval of stored transfer files
  4. 04Extortion of both direct customers and their downstream clients

T1190 Exploit Public-Facing ApplicationT1505.003 Web ShellT1213 Data from Information RepositoriesT1657 Financial Theft

The lesson

Concentration risk is real. File transfer products aggregate exactly the data that matters most, and one vulnerability in a widely deployed product reaches further than any single organisation's own security posture can compensate for.

What we test for

Third-party data concentration, whether file transfer platforms sit behind additional access control, and how quickly you can identify what data a compromised vendor held.

Snowflake customer environments · 2024 · Cloud data warehousing

165+ customer organisations

Customer accounts without MFA, accessed using infostealer-harvested credentials

A campaign targeted Snowflake customer tenants using credentials harvested by commodity infostealer malware, some years old. The affected accounts had no multi-factor authentication and no network allowlisting. The platform itself was not breached — the failure was distributed across customers' own identity configuration.

The chain

  1. 01Credential harvesting via commodity infostealer malware on contractor and employee devices
  2. 02Authentication to customer tenants where MFA was not enforced
  3. 03Bulk query and export of warehouse data
  4. 04Extortion and public listing of the stolen datasets

T1555 Credentials from Password StoresT1078.004 Cloud AccountsT1567 Exfiltration Over Web Service

The lesson

The shared responsibility model is where breaches live. The platform offered MFA and network policies; the affected tenants had not enabled them. Assume every credential your staff and contractors hold has already been stolen, and design so that it is not sufficient on its own.

What we test for

MFA enforcement across every SaaS and data platform, network policy coverage, and whether contractor devices sit inside your identity controls at all.

Change Healthcare · 2024 · Healthcare payments

~190 million individuals

Remote access portal without multi-factor authentication

Attackers used stolen credentials against a Citrix remote access portal that did not enforce multi-factor authentication, then moved laterally for over a week before deploying ransomware. The outage disrupted claims and prescription processing across the US healthcare system for weeks.

The chain

  1. 01Stolen credentials used against a remote access portal lacking MFA
  2. 02Nine days of undetected lateral movement and data staging
  3. 03Bulk exfiltration of protected health information
  4. 04Ransomware deployment causing sector-wide operational disruption

T1078 Valid AccountsT1133 External Remote ServicesT1074 Data StagedT1486 Data Encrypted for Impact

The lesson

Same root cause as Colonial Pipeline, four years later, at greater scale. A nine-day dwell time before deployment means detection had many opportunities and took none of them.

What we test for

Complete MFA coverage on every remote access path, and realistic dwell-time detection — whether staging and bulk collection generate an alert anyone acts on.