Where keeping it cost them

Uber

A contractor account nobody deprovisioned started the breach

An attacker bought a contractor's corporate password on the dark web, and the account still worked because it had never been closed.

standing access
least privilege

Removed: nothing. The contractor’s access was still live after the engagement ended.

Outcome: the attacker logged in with a purchased password, then worked up to elevated permissions across several tools.

The Uber 2022 breach happened because an attacker bought credentials from the dark web belonging to a contractor whose access wasn’t properly deprovisioned.

Source: Uber, Security update (16 September 2022)

More cases like this

Over-broad credentials turned an SSRF flaw into 106 million records

HVAC vendor credentials reached the payment network

Cut local admin accounts from 13,875 to 5,385

Left an internal admin tool behind employee accounts