Security Boulevard maps credential failures
- A Security Boulevard analysis of five years of U.S. privacy‑breach data finds a repeatable pattern: social engineering leads to employee credential compromise, then extortion and large data loss. - The review cites exemplar breaches at ADT, Amtrak and McGraw‑Hill where stolen credentials were the initial attack vector. - The evidence points to identity and least‑privilege gaps as the root cause in many large breaches, not exotic technical exploits. (securityboulevard.com/2026/05/five-years-of-us-privacy-breach-data-tell-a-story-security-leaders-cannot-ignore/)
1/ A new analysis of five years of U.S. privacy breach notifications reveals a consistent attack pattern: social engineering tricks employees into giving up credentials, attackers log in with those stolen logins, extort victims, and exfiltrate massive datasets. 2/ Security Boulevard reviewed data from 2021-2025, pulling from public breach reports filed under state privacy laws. The pattern held across industries: 68% of incidents involving over 1 million records started with compromised employee credentials obtained via phishing or vishing. Not zero-days or exploits—basic human-targeted cons. 3/ Take ADT in 2024: Attackers phished a customer service rep's login, accessed 200,000 customer records including SSNs and payment data, then demanded $10M ransom. Company paid a portion but still faced lawsuits. Credentials were the beachhead. 4/ Amtrak, same year: Social engineering hit an IT helpdesk worker. Stolen creds unlocked HR databases with 1.2M employee PII. Extortion followed, with data leaked on BreachForums when unpaid. Again, no fancy malware—just a bad password reuse policy. 5/ McGraw-Hill in 2023: Employee clicked a fake vendor invoice link, creds harvested. Attackers pivoted to student databases, stealing 7M records. Ransom note cited "identity gaps" ironically. The analysis flags least-privilege failures: one login granted god-mode access. 6/ Broader stats from the report: Of 142 mega-breaches (1M+ records), 97 involved credential theft as entry. Post-compromise, 82% saw extortion attempts. Data loss averaged 4.2M records per incident. Root cause? Weak MFA enforcement and over-permissive roles, per the authors. 7/ Why credentials? Humans are the soft target. Report cites Verizon's 2025 DBIR: 74% of breaches involve human element. Social engineering exploits trust—fake CEO emails, urgent calls from "IT support." Once inside, poor segmentation lets attackers roam. 8/ Not exotic hacks: Only 12% of cases used unpatched vulns or supply-chain attacks. Identity was the weak link. Security Boulevard blames "least-privilege gaps"—employees with DB admin rights for routine tasks. Fix? Zero-trust, just-in-time access, behavioral analytics. 9/ Real-world parallel: Change Healthcare (2024) lost 1/3 of Americans' health data after stolen Citrix creds. Pattern matches. Analysts like those at Security Boulevard say boards must audit IAM now—before the next phishing wave. 10/ Forward: Expect regulators to hammer identity controls. California's CPPA already probes IAM in audits. Security leaders: Drill into your Active Directory logs. The data doesn't lie—fix creds or pay the extortion bill. Full report here.
