All case studies

Where keeping it cost them

Twitter

Left an internal admin tool behind employee accounts

Attackers socially engineered Twitter employees to reach an internal admin tool; just-in-time access would have limited what the compromised accounts could do.

Removed: nothing. The admin tool was reachable from standing employee accounts, with no time-boxed elevation in front of it.

Outcome: a socially engineered employee account was enough to reach the internal admin tool.

The 2020 Twitter hack occurred because attackers socially engineered Twitter employees to gain access to an internal admin tool. If JIT access had been enforced, the compromised accounts would have had limited capabilities.

Source: Vice, reporting on the 2020 Twitter insider access hack (15 July 2020)