on the record

every one of these sounded reasonable at the time.

117 real, documented incidents. Each starts from a belief a sensible team held, follows what actually happened, and ends with the one thing worth checking in your own company this week.

when the myths broke.

One dot per incident, by the year it surfaced. Point at a dot to see which one; click to read it.

Dropbox, 2012

Target, 2013

Code Spaces, 2014

GitLab, 2017
Maersk / NotPetya, 2017

Marriott / Starwood, 2018
Amazon, 2018

Capital One, 2019
Facebook and Google, 2019
Maze / Allied Universal, 2019

Twitter, 2020
SolarWinds / Sunburst, 2020

Colonial Pipeline, 2021
Codecov / Bash Uploader, 2021
Power Apps misconfiguration, 2021
Kaseya VSA, 2021

Cash App / Block, 2022
Cisco, 2022
Illuminate Education, 2022
LastPass, 2022
Okta / Lapsus$, 2022
Ronin Network (Axie Infinity), 2022
Twilio (0ktapus), 2022
Uber, 2022
GitHub OAuth tokens, 2022
Toyota / GitHub key, 2022

Binance, 2026
Tycoon2FA, 2024-2026
Stryker, 2026

the peoplethe appsthe AIthe platformsthe wider record

the people.

Leavers, contractors, help desks, reused passwords and second factors that were not there.

Binance2026the money is safe as long as the keys never leaveWhatever is allowed to ask for a withdrawal can empty the wallet, wherever the key happens to be.
Tycoon2FA2026we have MFA, so phishing is handledPrompt-and-code MFA stops the password thief, and the market answered with the session thief.
Coinbase2025support agents can see customer data, but they can't take it anywhereAnything a support agent can see, someone can pay them to photograph.
Coupang2025when someone leaves the company, their access leaves with themOffboarding is a security control, and it fails like one.
Discord2025our support vendor only sees what it needs to answer ticketsA support desk sees everything customers have ever sent it, and so does whoever gets into the desk.
Marks & Spencer2025a breach hurts our reputation but won't dent the bottom line muchA breach that reaches the systems you sell and operate through is not a reputational event with a financial footnote.
Change Healthcare2024one MFA exception won't matterMFA coverage is binary per door, and attackers inventory doors.
KnowBe42024a clean background check means we know who we hiredA background check confirms that an identity exists. Someone else can still be using it.
Roku2024accounts with no card on file are low-riskThe thing worth stealing was never the watchlist.
The Snowflake wave2024a leaked password from 2021 is deadA leaked credential does not age out.
23andMe2023our customers' passwords are their own responsibilityWhen one account can read across the network to thousands of others, the password on that single account stops being a personal matter and becomes a structural one.
Caesars Entertainment2023our outsourced IT vendor is just supportAn outsourced vendor's access is your access, and their attack surface is yours.
CircleCI2023a CI vendor's breach does not reach our tokensEvery secret you store in a build pipeline is reachable by whoever can act as a privileged employee of that vendor, and a stolen session can make them one.
CitrixBleed (CVE-2023-4966)2023once we apply the patch, the attackers are locked outA patch closes the way in, it does not evict whoever already came through.
Clorox and Cognizant2023our outsourced help desk verifies identity before resetting accessA verification procedure protects you only when it is the gate every reset has to pass through, not a policy that exists alongside a busy queue.
Cloudflare2023we patched the vendor breach, the old credentials can waitA credential you believe is unused is still a credential, and "probably inactive" is a guess until someone checks.
Ledger Connect Kit2023a small front-end library we embed can't drain our usersA dependency you embed runs with your users' trust, not its own.
MGM Resorts2023a ten-minute phone call can't take down a casinoThe help desk is an identity control, and a confident caller is an attack against it.
Norton (Gen Digital)2023a password-manager account is safe even if i reuse passwords elsewhereThe vault is only as private as the single credential that opens it, and reusing that one credential quietly cancels the benefit of every unique password inside.
PayPal2023a successful login with the right password must be legitimateA correct password proves a credential matches, not that the right person is using it.
Reddit20232FA stops credential phishingCode-based and prompt-based 2FA stops a reused password, not a real-time relay.
Retool2023if everyone uses an authenticator app, our MFA is solidMulti-factor authentication only holds if the second factor stays separate from the first, and a convenience setting that backs codes up to the cloud can erase that separation without anyone choosing it.
The British Library2023we rolled out MFA, so our remote access is coveredA risk you have documented is not the same as a risk you have closed, and "mitigated" can quietly mean "written down and lived with." The exception the rollout left behind was the one the attacker used.
Cash App / Block2022revoking the badge revokes the accessEnding employment and ending access are two separate acts, and only the first happens automatically.
Cisco2022credentials in a browser stay in the browserBrowser sync carries credentials wherever the personal account goes, including into an attacker's hands if that account is breached.
Illuminate Education2022keys from someone who left years ago are dead by nowThe FTC alleges that an administrator's cloud key pair kept working years after the person left, and that it was the way in to student data.
LastPass2022a key engineer's home device is out of scopeScope is defined by access, not by who owns the hardware.
Okta / Lapsus$2022a subprocessor's laptop cannot reach our customers' dataA subprocessor is not far from your data.
Ronin Network (Axie Infinity)2022a permission we stopped using is a permission nobody hasA permission you stop using keeps working until someone removes it.
Twilio (0ktapus)2022our staff won't fall for a text messageA trained workforce reduces clicks; it never zeroes them, and an attacker only needs one.
Uber2022an MFA prompt means a human is paying attentionA push prompt is only a control if the person tapping it is alert and certain.
Colonial Pipeline2021a dormant account is a safe accountTo an attacker a dormant account is a live credential with a leaked password and nobody watching, which is the easiest kind of door there is.
Twitter2020our admin tool is internal, so only our own staff can use itAn internal tool is used by whoever is signed in as your staff, and a phone call can arrange that.
Code Spaces2014backups in the cloud mean we can always recoverA backup that shares an account, and an admin login, with production is not a separate copy; it is the same target.
Target2013a small supplier can't be a way into usA supplier's size describes the supplier. It says nothing about the access.
Dropbox2012a personal password leak stays personalA password is not attached to the account where it was first used; it is attached to every account where it was used again.

the apps.

Vendors, integrations and OAuth grants that carried access nobody was watching.

Bybit2025if every signer checks the screen, the transfer is what it saysA multisig wallet is only as honest as the screen every signer reads.
Gainsight / Salesforce2025the salesloft breach was a one-off, and that lesson belongs to somebody elseOne incident is an event; the second is a pattern.
Salesforce vishing campaign (UNC6040)2025we have MFA on salesforce, so nobody gets in without us noticingIn the Salesforce vishing campaign an employee approved the attackers' app during a phone call, and the FBI assesses that approval bypasses MFA, password resets and login monitoring.
Salesloft / Drift2025a breach at a small vendor stays a small breachAn OAuth token is a key that works from anywhere and answers to nobody's laptop, badge, or VPN.
Cisco Duo2024turning on SMS MFA closes the doorSMS MFA protects the code, but the phone number underneath it is a credential of its own, and it lives in systems you do not run.
Cyberhaven2024an extension from a security company is safe to keep installedA browser extension is whatever its latest update says it is, and updates install themselves.
Dell2024our partner portal is gated, so the data behind it is safeA gate decides who comes in, not what they can carry out, and an interface that answers one safe-looking question will answer it millions of times if nothing is counting.
Dropbox Sign2024a service account is just background plumbingA service account is an identity with credentials and reach, and an over-privileged one is a master key nobody is guarding.
Microsoft Midnight Blizzard2024a retired test tenant is harmlessA retired environment is only harmless if its access retired with it.
Sisense2024our analytics SaaS only sees dashboards, not our credentialsA tool that reports on your systems is also a tool that can reach your systems, and the credentials it holds to do its job are yours to lose when it is breached.
Trello2024public profile data is harmless, there's nothing to stealPublic data is safe in ones and dangerous in bulk.
Twilio Authy2024an endpoint with no login isn't a real exposureA read-only endpoint with no login is still a credential check if it confirms which accounts exist.
US Treasury and BeyondTrust2024a SaaS API key is not really a credential to protectA key that authenticates with no person and no second factor is among the most powerful credentials a system holds, precisely because nothing stands between it and the door.
Mailchimp2023our internal support tooling is safe because it's internalInternal tooling is only as safe as the credentials that open it, and powerful support tools are a prize precisely because of what they can reach.
Okta / support HAR files2023files we upload to a vendor's support portal are harmlessA file uploaded to support is only as harmless as what it contains, and a browser recording can contain a live session.
GitHub OAuth tokens2022an integration only touches what we connected it toAn OAuth token is reach. The relationship behind it can end while the reach stays.
Marriott / Starwood2018we'd notice if someone was in our systemsNoticing has to be built into a system. It does not happen on its own.

the AI.

Assistants, agents and AI tools that reached data through permissions they inherited.

AI espionage via Claude Code2025AI assists attackers; humans still do the hackingAn agent capable enough to do real work for you is capable enough to do real work for an attacker who can frame the task.
Brewer v. Otter.ai2025it's just a notetakerA notetaker is a data processor attending your meetings, and the weight of what it records lands on the companies in the room, not only on the vendor that built it.
ChatGPT shared links2025a shared AI chat link only shows it to the person i send it toA share control and a publish control can sit one checkbox apart, and the word that separates them can read like a convenience rather than a decision.
DeepSeek exposed database2025the AI vendor secures the prompts we send itThe security of your prompts is exactly as good as the vendor's weakest configuration, which you cannot see and did not vet.
EchoLeak / Microsoft 365 Copilot2025for an attacker to reach our data, someone here has to click somethingAn AI assistant inherits every permission its user holds, and it reads what arrives without judging who sent it.
Lenovo Lena chatbot2025our customer chatbot is just a harmless FAQ widgetA chatbot is a channel that takes untrusted input and produces output your systems then act on.
MCP tool poisoning2025a tool's description can't carry an attackFor an AI agent, a tool's description is an instruction it reads, which makes the description an attack surface.
Replit agent database deletion2025an agent will respect a code freeze and an approval gateAn agent's access is real and its respect for your rules is not guaranteed.
Disney / NullBulge2024an employee's pet AI tool can't touch productionA personal device and a work account are not separate systems when one holds the credentials to the other.
Slack AI training default2024our SaaS won't train on our messages by defaultA vendor's default is a decision made for you until you find it and change it.
Amazon Q2023an enterprise AI assistant is safer than consumer ChatGPTEnterprise describes who a tool is sold to, not how it behaves under load.
ChatGPT Redis bug2023my AI chat session is private to meA session that feels private to you is still running on infrastructure shared with everyone else using it.
Samsung2023it's just a chatbotA prompt is an upload.

the platforms.

Code hosts, clouds and collaboration suites where a key, a token or a default opened the door.

Shai-Hulud npm worm2025a token on a developer laptop is only as dangerous as the one package it publishesThe worm used publish tokens stolen from developers to republish up to 20 other packages of the same maintainer, so a developer's token became the supply chain.
tj-actions/changed-files2025a popular open-source CI helper is too widely-used to be riskyPinning to a version tag trusts that the tag will keep pointing where it pointed.
Internet Archive2024hashed passwords mean a stolen auth database is fineHashing protects the passwords. It does nothing for the door to the database.
ServiceNow Knowledge Base2024our SaaS defaults are secure, so configuration is the vendor's jobA secure default and a secure configuration are not the same thing.
Microsoft AI data exposure2023a share link only shares the file you meantA share link inherits the permissions of the scope it was cut from, not the file you were looking at.
Storm-05582023our cloud email is safe because we control who logs inControlling who logs in protects you only as far down as the layer you can see.
Toyota cloud exposure2023a misconfigured bucket gets caught quicklyA misconfiguration is not self-correcting, and without something that checks, an exposure can last for years.
Toyota / GitHub key2022a secret checked into a repo goes stale harmlesslyA secret committed to a repository stays exactly as usable as the day it was written, for as long as the repository is reachable and the key is not rotated.
Codecov / Bash Uploader2021a secret in our CI is low riskA secret in your pipeline is a live credential to something real, and the pipeline is not a vault.
Power Apps misconfiguration2021defaults are safe defaultsA default is a decision the vendor made for you, and it is not always the safe one.
Capital One2019a managed cloud means the cloud is secure for usA managed cloud secures the platform and leaves your configuration to you, and the configuration is where breaches happen.

the wider record.

Incidents outside access itself, kept because the assumption behind them is the same kind of mistake.

Stryker2026the device management console is just an IT toolThe console that manages every company device can also remove everything from them, and CISA's alert after Stryker's March 2026 incident treats it that way.
AI hallucination court wave2025only careless solo lawyers cite fake AI casesAI fabrication is a property of the tool, not a failing of careless users alone.
Cursor support bot2025an AI support bot can speak for company policyA bot can produce text in the company's voice without producing the company's policy.
Hancock declaration2025an expert's sworn court filing is reliably fact-checkedA signature and a credential do not verify a citation.
Jaguar Land Rover2025a factory's risk is physical safety; cyber won't stop the lineIn a software-run plant, the line and the network are the same system.
Mobley v. Workday2025a hiring algorithm is a neutral filter, not a legal liabilityA screening tool does not absorb the legal responsibility for who it screens out.
Singapore deepfake call2025a live video call proves the people on it are realA live call now shows you a face and a voice, and neither one is evidence of identity any more.
Taco Bell automated drive-thru2025once it scales, drive-thru voice AI runs itselfVolume proves a system can repeat what it already does well.
Arup deepfake fraud2024if i can see and hear them, it's really themA face and a voice on a screen are now things software can manufacture.
Ascension2024hospitals can keep running normally through an IT incidentA hospital can keep treating patients through an IT incident, and doing so for six weeks is a different thing than doing so for an afternoon.
CDK Global2024a vendor outage is an inconvenience, not a stoppageWhen one vendor runs the core of the business, the question is not whether they will have an outage.
CrowdStrike2024a trusted security vendor's auto-update can only helpA trusted vendor's automatic update is a change entering your environment without your review, and the trust you place in the channel is also the speed at which a single mistake reaches everything at once.
DPD chatbot2024our support bot can't be turned against the brandA bot speaks for the brand only as long as something is actively holding it to the role.
Ferrari2024if the voice sounds exactly like our CEO, the request is realA voice is no longer proof of a person.
Klarna AI customer service2024AI can replace the customer-service team outrightA system can carry most of the volume and still not be the whole job.
McDonald's automated drive-thru2024voice AI is ready to take customer orders unsupervisedA model that produces the right answer most of the time is not the same as a model ready to be trusted without a person watching.
Moffatt v. Air Canada2024a chatbot's answer isn't a company promiseA chatbot speaks for the company that deploys it.
NYC MyCity chatbot2024an official AI assistant gives lawful answersAn official wrapper transfers authority to the answer without transferring accuracy to it.
Orion2024wire-transfer fraud only catches small, careless companiesWire fraud does not test your firewall.
Polyfill.io2024a tiny JavaScript helper can't compromise our siteA third-party script you embed is code you run on behalf of whoever controls it today, not whoever controlled it when you added it.
Stoli Group2024a ransomware hit is recoverable; it won't threaten survivalRansomware is often recoverable, and whether it is depends on which system it lands on and what that system was holding up.
Synnovis2024a cyberattack is an IT problem, not a safety problemWhen the systems that carry a clinical result go down, the consequence does not stay inside the data centre.
WPP2024a meeting with our CEO's face and voice can't be fakedA familiar face and a matching voice are no longer proof of who is on the call.
XZ Utils2024a widely-used open-source library is well-watched, so it's safeOpen source is watched by people, and people can be befriended, exhausted, and outlasted; a library being everywhere does not mean anyone is positioned to see a patient insider who arrived looking like a volunteer.
3CX2023a signed update from our vendor is safe to installA signature proves who built the software, not what happened to it before they built it.
Chevrolet dealership chatbot2023a public AI chatbot stays on scriptA general-purpose model wearing a single-purpose costume keeps all of the general-purpose model underneath.
CNET2023AI can quietly produce publishable content at scaleFluent and correct are not the same property, and an AI tool delivers the first reliably while the second still depends on a person checking.
Garante / ChatGPT2023a regulator won't move on an AI tool yetThe enforcement clock for an AI tool is not the age of the tool; it is the age of the law it touches.
iTutorGroup2023an automated screener can't discriminateA screen does not become fair by being automatic.
JetBrains TeamCity2023our internal CI/CD build server isn't an attacker targetA build server is not a tool that sits below the things worth protecting.
Mata v. Avianca2023ChatGPT's case citations can be trustedA model produces the shape of a fact with the same fluency whether or not the fact exists.
MOVEit / Clop2023a tool our vendors use isn't our problemYour attack surface is not the list of tools you run; it is the list of tools that touch your data, including the ones three companies removed from you.
Sports Illustrated2023a byline on a trusted brand was written by a real personThe signals that make content feel human, a name, a face, a bio, are now things that can be manufactured as easily as the content itself.
Kaseya VSA2021patching my own systems is enoughYour exposure includes every privileged tool and provider with reach into your systems, not just the systems you patch yourself.
SolarWinds / Sunburst2020a certified vendor is a safe vendorA certification tells you a vendor met a standard at a point in time.
Facebook and Google2019an invoice from a known supplier is genuineA familiar name on an invoice is not proof of who sent it.
Maze / Allied Universal2019with backups, ransomware can't really hurt usBackups answer encryption. They do nothing about theft.
Amazon2018an AI hiring tool is objectiveA model trained on who got hired before learns to repeat who got hired before.
GitLab2017our backups have us coveredA backup that has never been restored is a hope.
Maersk / NotPetya2017our domain backups are safe somewhereA backup reachable by whatever destroys the original is not a backup.