OpSec vulnerabilities

In May 2025, Coinbase disclosed that cybercriminals had bribed overseas customer-support contractors to steal personal data on about 69,461 customers, then used that data to run convincing scams against Coinbase users. The insiders had legitimate access to support tools for their jobs; they abused it to pull records they had no business reason to see. No passwords, private keys, two-factor secrets, or customer funds were taken. The attackers demanded a $20 million ransom to stay quiet. Coinbase refused, offered a $20 million bounty for information leading to their arrest instead, and estimated the cleanup and customer reimbursements at $180 million to $400 million in an SEC 8-K filing.

The Internet Archive, the nonprofit behind the Wayback Machine, had a brutal October 2024: a data breach, a website defacement, and a wave of DDoS attacks, all at once. Underneath the chaos was an unglamorous root cause. An authentication token sat in plain text in a public config file; the team rotated it repeatedly, but each new token landed right back in the same exposed file, so the leak never actually closed. With it, an attacker downloaded the source code, found more credentials hardcoded inside, and walked out with a database of 31 million users. Weeks later a second token from that same stolen code, for the support system, exposed 800,000 support tickets, some with people's ID documents. It is the lesson that rotating a secret is useless if it goes straight back into a public file, and that one leak unravels everything.

In mid-2024, a single gap, accounts without multi-factor authentication, turned into one of the largest waves of data theft ever, hitting Ticketmaster, AT&T, Santander, and around 165 other companies at once. The attackers never broke Snowflake, the cloud data platform all of them used. They simply logged in with valid usernames and passwords, harvested months or years earlier by infostealer malware from employees' personal computers and bought on criminal markets. Where MFA was not turned on, a stolen password was a full key. It is the defining lesson of the infostealer era: your breach can start on an employee's home laptop, and MFA is the difference between a leaked password and a catastrophe.

Publicly disclosed January 30, 2024, a Mercedes-Benz employee accidentally committed a GitHub authentication token to a public repository, leaving it exposed from September 29, 2023. RedHunt Labs found the token during an internet-wide scan; it granted unrestricted, unmonitored access to Mercedes-Benz's internal GitHub Enterprise Server, allowing anyone to download private source-code repositories that could contain API keys, cloud access keys, database connection strings, blueprints, and SSO passwords. After notification, the token was revoked on January 24, 2024. Mercedes-Benz stated customer data was not affected but could not confirm whether anyone besides the researchers accessed the repositories during the exposure window.

In January 2024, Microsoft revealed that Russia's foreign-intelligence service, the same APT29 behind SolarWinds, had been reading the email of its senior leadership. The way in was almost insulting in its simplicity: a forgotten, non-production test account with a weak password and no MFA. The attackers guessed the password by spraying common ones across many accounts, then pivoted through a forgotten over-privileged application to grant themselves access to corporate mailboxes, including those of executives and the security and legal teams. It is the lesson that your security is only as strong as the account you forgot about, and that even Microsoft's perimeter fell to a missing MFA checkbox.

Okta is an identity provider: the single front door thousands of companies use to log their employees into everything. So when Okta's customer-support system was breached in late 2023, the blast radius was a who's-who of security-conscious companies. The entry point was almost mundane. An employee had signed into their personal Google account on an Okta laptop and saved a corporate service-account password into it; the attacker got that password and walked into Okta's support system. There they downloaded diagnostic files that customers had uploaded, some of which contained live session tokens, and used those tokens to step directly into the customers' own Okta environments. It is the lesson that session tokens are as good as passwords, support systems are production systems, and a personal browser profile can be the crack in the wall.

23andMe held the most personal data there is: people's DNA. In 2023 attackers got into more than 18,000 accounts and, through a single social feature, turned that into the genetic and ancestry data of roughly 6.9 million people. The break-in required no flaw in 23andMe at all. Attackers simply took username-and-password pairs leaked from other companies' breaches and tried them, betting, correctly, that people reuse passwords. The accounts had no MFA, and 23andMe did not notice the five-month wave of automated logins. From those footholds, the attackers scraped relatives' data through an opt-in feature, and the fallout, fines, a $50 million settlement, and ultimately bankruptcy and a fire-sale of the DNA database itself, shows that a breach can be fatal even when your own systems were never hacked.

Microsoft's AI research team shared open-source training data via an Azure Storage Shared Access Signature (SAS) token committed to a public GitHub repo around July 2020. The token was misconfigured to scope access to the entire storage account with full-control permissions instead of the intended read-only bucket, so anyone with the link could view, delete, and overwrite files. Wiz researchers discovered it in June 2023, finding 38 terabytes of exposed internal data including two employees' workstation disk backups with secrets, private keys, passwords, and over 30,000 internal Teams messages. Writable pickle-format models created a model-poisoning supply-chain risk; Microsoft revoked the token and reported no customer data was exposed.

In September 2023, two of the biggest names in Las Vegas, MGM Resorts and Caesars Entertainment, were brought to their knees, not by a sophisticated exploit, but by a phone call. The Scattered Spider group simply called the companies' IT help desks, impersonated employees, and talked the support staff into resetting their multi-factor authentication, handing the attackers a way in. From there they deployed ALPHV/BlackCat ransomware. Caesars paid about $15 million; MGM refused and took a roughly $100 million hit as slot machines, hotel keys, and check-in systems went dark for days. It is the lesson that the help desk is part of your attack surface, and that the most advanced MFA is undone by a human who can be convinced to reset it.

On July 14, 2023, a Sourcegraph engineer accidentally committed an active site-admin access token in a pull request, and automated secret-scanning controls failed to catch it. On August 30, 2023, an attacker used the leaked token to elevate a newly created account to site-admin and access the administrative dashboard. The attacker raised API rate limits and created a public proxy app granting arbitrary users free access to Sourcegraph's APIs and underlying LLM, with instructions spreading widely online. License-key recipient names and emails, a subset of customer license keys, and community account email addresses were exposed; Sourcegraph stated no private code or passwords were compromised.

CircleCI runs the build pipelines for thousands of engineering teams, which means it holds their deepest secrets: the deploy keys, API tokens, and credentials that move code to production. In December 2022, all it took to reach those was malware on one engineer's laptop. An infostealer that antivirus never caught lifted a valid, 2FA-protected login session straight out of the engineer's browser, letting the attacker walk in as that engineer with the second factor already satisfied. They reached production stores of customer secrets, forcing CircleCI to tell every customer to rotate every credential they had ever stored. It is the lesson that a stolen session cookie bypasses MFA, and that one infected laptop can compromise thousands of pipelines.

LastPass is a password manager, the digital vault tens of millions of people trusted with every password they have. In 2022 attackers got into it, and the breach unfolded in a way that turned a developer's home computer into a path to those vaults. A first intrusion stole source code. The attackers used it to identify and target one of only four engineers who held the keys to production backups, planting a keylogger on his home PC through an unpatched flaw in, of all things, his Plex media server. With his master password captured, they exfiltrated backups of customers' encrypted password vaults. The encryption held, but anyone with a weak master password was now exposed to offline cracking at the attacker's leisure. It is the lesson that a vault is only as strong as the master password protecting it, and that your blast radius includes your engineers' home machines.

In September 2022, an 18-year-old broke into Uber and posted screenshots of its internal systems to prove it, an embarrassingly total compromise that started with a tactic anyone can fall for: pestering. The attacker, part of the Lapsus$ group, had a contractor's stolen password, and to get past multi-factor authentication, simply spammed the contractor with login-approval prompts until, worn down and then nudged over WhatsApp by the attacker posing as IT, they tapped "approve." Once inside, the attacker found a script with a hardcoded admin password that unlocked Uber's most powerful systems at once. It is the textbook lesson in MFA fatigue, and in how one hardcoded secret turns a foothold into a takeover.

On 7 August 2022, Twilio, a company whose entire business is sending text messages and verification codes for other companies, was breached through text messages. Attackers ran an SMS phishing campaign against Twilio's own employees, texting them fake "your password expired" alerts from numbers that looked like Twilio IT and linking to convincing fake login pages. Several staff entered their credentials, handing over access to internal tools and the data of more than 200 customers, and rippling downstream to users of the secure-messaging app Signal. It was one strike in a sprawling campaign, dubbed 0ktapus, that phished around 130 companies the same way. It is the lesson that phishing-resistant MFA exists for a reason: ordinary credentials and codes can always be talked out of a human.

In April 2022, an attacker abused OAuth user tokens issued to two third-party integrators, Heroku and Travis CI, to authenticate to the GitHub API and download private repositories from dozens of organizations, including npm and GitHub itself. An AWS API key obtained from data downloaded with a stolen OAuth token was then used to access npm production infrastructure. GitHub stated the tokens were not compromised on its own systems, pointing the root cause to the third-party integrators, which revoked all affected OAuth tokens. Affected organizations and private-repo owners were notified.

On 7 May 2021 the DarkSide ransomware crew hit Colonial Pipeline, operator of the largest fuel pipeline in the United States, and the company shut down operations for six days, triggering fuel shortages and panic buying across 17 states. The entry point was mundane: a single leaked password for a legacy VPN account that was no longer used but had never been disabled, and that was not protected by multi-factor authentication. With that one credential the attackers reached the IT network, deployed ransomware, and stole about 100 GB of data. Colonial paid roughly 75 BTC (about $4.4 million) the day after the attack, most of which the US DOJ later clawed back. It is the case study for MFA everywhere and for killing dormant accounts.

On 15 July 2020, the Twitter accounts of Barack Obama, Joe Biden, Elon Musk, Bill Gates, Jeff Bezos, and Apple all tweeted the same thing: send Bitcoin and I will send back double. It was a scam, and it ran from inside Twitter. Attackers had phoned a handful of Twitter employees, posed as IT, and talked them out of their credentials, which gave access to an internal admin tool that could take over any account on the platform. The mastermind turned out to be a 17-year-old. It is the lesson that a powerful internal "god-mode" tool is only as secure as the most socially-engineerable employee who can reach it.

In November 2018 Marriott disclosed that the Starwood guest-reservation database had been breached. The headline number moved as the investigation went on, from an initial 500 million down to a refined estimate of around 339 million guest records, including 5.25 million unencrypted passport numbers. The most striking detail was the dwell time: attackers had been inside the Starwood system since July 2014 and went undetected for more than four years, straight through Marriott's 2016 acquisition of Starwood. Marriott inherited the compromised infrastructure without knowing intruders were already in it, and only an internal security tool flagging an unusual database query in September 2018 finally surfaced the breach, which US government sources attributed to Chinese state-linked actors. It led to a $52 million multi-state settlement and a 20-year FTC security order. It is the lesson in mergers-and-acquisitions cyber due diligence, dwell-time detection, and protecting and encrypting sensitive records.

Yahoo suffered the largest data breach ever recorded: an August 2013 intrusion that, after later revisions, was found to have exposed all three billion of its user accounts, plus a separate state-sponsored 2014 breach of about 500 million accounts. Stolen data included names, emails, phone numbers, dates of birth, security questions and answers, and, in the larger 2013 breach, passwords hashed with the weak, fast MD5 algorithm, which made them practical to crack. In the 2014 breach the attackers also stole Yahoo's account-management tooling and forged authentication cookies to log into accounts with no password at all. Yahoo knew of the breaches but did not disclose them until 2016, during Verizon's acquisition, which cut the purchase price by $350 million and earned the first-ever SEC fine for failing to disclose a breach. It is the lesson in strong password hashing, session-cookie integrity, MFA, and timely, honest disclosure.

In 2015 the US Office of Personnel Management disclosed one of the most damaging government breaches in history. Attackers widely attributed to China stole background-investigation records on about 21.5 million people: the SF-86 security-clearance forms that catalogue relatives, finances, foreign contacts, mental-health history, and other intimate detail, along with 5.6 million sets of fingerprints. A separate intrusion took personnel records on 4.2 million federal employees. Initial access came through a contractor's credentials, there was no multi-factor authentication on key systems, the data sat unencrypted, and the intruders dwelt undetected for about a year. OPM had been warned for years about exactly these gaps. It is not a story about money; it is a counterintelligence catastrophe, and a lesson in MFA, contractor access, encryption, and minimising the most sensitive data you hold.

In 2015 the US health insurer Anthem disclosed the theft of about 78.8 million records, then the largest healthcare breach in history. It began in February 2014 with a single spear-phishing email: an employee at an Anthem subsidiary clicked a link to we11point.com, a look-alike of the company's real wellpoint.com domain, which planted malware and handed attackers a foothold. From there they captured the credentials of a database administrator and queried a data warehouse where nothing was encrypted, walking out with names, dates of birth, Social Security numbers, addresses, and employment and income data. US prosecutors later attributed the intrusion to a China-based group and indicted Fujie Wang. It is the lesson in phishing-resistant MFA, encrypting sensitive data at rest, and watching privileged database access.

In November 2014 a group calling itself the Guardians of Peace tore through Sony Pictures Entertainment, and the FBI attributed the attack to North Korea, tied to the studio's comedy The Interview. The attackers had deep, prolonged access: they stole terabytes of data and then ran wiper malware that bricked thousands of computers and servers, forcing Sony off its own network for weeks and back to pen and paper. The leaks were brutal and public, including unreleased films, employee Social Security numbers and salaries, and embarrassing executive emails. Access reportedly began with stolen credentials and a flat internal network that let the intruders roam and stage destruction. It is the case that proved a breach can be about humiliation and coercion, not just theft, and a lesson in segmentation, least privilege, detection, and resilient backups against a destructive, state-backed adversary.

During the 2013 holiday shopping season, attackers stole about 40 million payment-card numbers and personal data on roughly 70 million Target customers, one of the largest retail breaches in history. They did not start at Target. They started at Fazio Mechanical, a refrigeration and HVAC contractor that held an account on Target's vendor portal for billing and project management, phished its staff, and stole its login. Contrary to the popular retelling, Fazio had no remote access to Target's heating or refrigeration systems; it was an ordinary billing account. But because Target's network was flat, that low-value vendor login became a path all the way to the checkout lanes, where the attackers installed memory-scraping malware on the registers to grab card data as it was swiped. Target's own recently deployed detection system caught the malware and raised alerts, and the alerts were not acted on. The breach cost well over $200 million and became the defining lesson in third-party risk, network segmentation, and actually responding to your own alarms.