Target
HVAC vendor credentials reached the payment network
Compromised HVAC vendor credentials crossed into the payment network because segmentation was not there. 40 million credit cards were stolen.
All case studies
Twitter
Standing Access
11 case studies tagged standing access.
NASA OIG
Cut local admin accounts from 13,875 to 5,385
A 2026 audit found NASA's process for workstation administrator rights effective, with deprovisioning keeping pace with provisioning.
Left an internal admin tool behind employee accounts
Attackers socially engineered Twitter employees to reach an internal admin tool; just-in-time access would have limited what the compromised accounts could do.
Uber
A contractor account nobody deprovisioned started the breach
An attacker bought a contractor's corporate password on the dark web, and the account still worked because it had never been closed.
Kaseya
An RMM agent carried one compromise into 1,500 businesses
A remote monitoring agent with extensive permissions across customer networks turned into a lateral movement tool once it was compromised.
DHS OIG / CBP
Found all 76,000 network users could reach one privileged account
A 2026 audit traced a 2019 flaw that gave every CBP network user access to a powerful service account, plus offboarding that missed hundreds of leavers.
Tesla
Left a Kubernetes dashboard open with an over-privileged account
An administrative console was reachable without authentication, and the service account credentials behind it could do more than the workload needed.
CircleCI
Held long-lived customer secrets until they leaked
OAuth tokens and API keys sat in CircleCI's systems until they leaked; customers already using short-lived credentials had much less to replace.
LastPass
Reached a storage bucket through a personal cloud account
Federated access from a personal cloud account linked to corporate resources carried attackers into a cloud storage bucket.
GitLab
Removed the OAuth password grant entirely
Client authentication was required from April 2025, then the Resource Owner Password Credentials grant was deleted rather than restricted.
Microsoft
Traced stolen OAuth tokens into mailboxes
In its Solorigate analysis, Microsoft showed OAuth tokens reaching email and other resources without needing passwords or MFA.