2025 credential breaches show why basics still fail at scale

At a glance

What this is: This retrospective on 2025 breach patterns shows that healthcare, Salesforce-related customer exposures, and infostealer-driven credential dumps kept scaling despite AI hype.

Why it matters: IAM and NHI teams should treat credential monitoring, MFA, and offboarding hygiene as core controls because the same basic failures keep feeding broad compromise at enterprise scale.

Context

The security gap here is not a new exploit chain but a persistent failure to govern credentials, third-party access, and reuse at scale. When stolen login data can be recycled into large credential dumps, the control problem becomes identity hygiene across people, workloads, and supplier-connected systems.

The article’s 2025 retrospective points to three recurring pressure points: healthcare breach volume, customer exposure through Salesforce-connected environments, and infostealer-driven credential markets. That makes this a governance story about how compromised access keeps circulating long after the original source event.

The identity lesson is broader than one sector or one attack family. If an organisation cannot inventory, monitor, and revoke exposed credentials quickly, the same material can move from theft to account takeover, fraud, or downstream compromise with very little friction.

Key questions

Q: What fails when exposed credentials are not monitored across the identity estate?

A: The failure is visibility, not just policy. When organisations cannot see credentials in infostealer logs, ULP lists, or breach feeds, they lose the chance to invalidate stolen access before it is reused for account takeover or fraud. Monitoring has to be tied to revocation, because detection without action still leaves valid credentials in circulation.

Q: Why do third-party systems increase breach spread?

A: Third-party systems increase breach spread because organisations often trust the business relationship more than the control environment behind it. If vendor access is weakly scoped, poorly reviewed or not fully offboarded, an attacker can move from one compromised integration into more sensitive systems. The problem is trust propagation without lifecycle governance.

Q: Should organisations rely on MFA alone after a credential dump?

A: No. MFA can reduce the value of stolen passwords, but it does not erase the underlying exposure when secrets are dumped from storage or memory. Organisations need layered controls that limit reuse, reduce privilege, and restrict where credentials are stored and loaded. MFA is containment, not a substitute for secret lifecycle governance.

Q: What should IAM teams do after credential stuffing succeeds on a login?

A: Treat a successful stuffed login as a verified account compromise, not as an isolated authentication event. Revoke active sessions, review connected services, check for password resets or privilege changes, and look for fraud or lateral access from the same source pattern. The key is to investigate the cluster, not only the account.

Technical breakdown

Why ULP lists make credential reuse so effective

ULP lists are credential dumps organised as URL, login, password, which gives attackers both the secret and the exact login endpoint. That makes reuse far more efficient than random credential testing because the attacker can go straight to a known valid destination. Browser-based password managers and infostealer malware increase the yield by collecting credentials together in usable form. For defenders, the technical issue is not only theft but the conversion of stolen identity data into fast, repeatable access attempts.

Practical implication: treat exposed credentials as immediately reusable attack material, not just evidence of past compromise.

How infostealer malware turns local compromise into enterprise risk

Infostealers target endpoints, but the business impact arrives when harvested browser data, saved passwords, and session-related artefacts are sold or traded. Access brokers then package that material for credential stuffing, fraud, and broader intrusion attempts. The result is a pipeline from one compromised device to many accounts across different services. This is why endpoint security and identity controls have to be read together: one detects collection, the other limits what stolen access can do next.

Practical implication: connect endpoint detection with credential monitoring so stolen login data is detected before reuse spreads.

Why AI amplifies old identity attacks instead of replacing them

The article argues that AI did not create a new dominant breach pattern in 2025. Instead, it increased the volume and reach of phishing and credential stuffing, which are already effective when identity hygiene is weak. That matters because the attack economics improve even when the technique does not fundamentally change. In practical terms, AI acts as a scale multiplier on weak identity controls, especially where passwords are reused and compromised credentials are not monitored.

Practical implication: assume AI will increase the speed and scale of familiar identity attacks, then harden the controls those attacks already depend on.

Threat narrative

Attacker objective: The attacker wants usable credentials at scale that can be recycled into account takeover, data theft, and downstream monetisation.

1. Entry begins with infostealer malware collecting browser-saved credentials, URLs, and passwords from endpoints and packaging them into ULP lists.
2. Credentialed access is then traded through access brokers and used for credential stuffing, phishing follow-on, and account takeover attempts against the identified login endpoints.
3. Impact follows when those compromised credentials are reused to steal data, expand access across third-party-connected systems, or trigger downstream fraud and ransomware activity.

Breaches seen in the wild

• Code Formatting Tools Credential Leaks: Widely used code formatting tools cause massive credential and secrets leaks in enterprise environments.
• tj-actions/changed-files compromise 2025: A stolen bot token let attackers poison tj-actions/changed-files so pipelines printed their CI/CD secrets to public logs (CVE-2025-30066).

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Credential reuse is now the durable breach substrate: The 2025 pattern is not about one spectacular exploit, but about recycled access persisting across sectors and services. Once login data is harvested, the same identity material can be replayed into account takeover, fraud, or secondary intrusion with minimal extra effort. That makes identity hygiene the first-order control plane, not an administrative afterthought.

Third-party exposure creates identity blast radius: The Salesforce-related incidents described in the article show how customer environments can absorb the impact of supplier-connected access and data storage choices. The governance failure is not just vendor trust, but the absence of clear ownership for the identities and credentials that bridge organisational boundaries. Practitioners should treat connected access paths as part of the governed identity estate.

AI did not replace old identity attacks, it industrialised them: The article’s strongest signal is that AI increased throughput for phishing and credential stuffing rather than changing the core breach logic. That means the controls that were already weak, password reuse, compromised credential detection, and MFA coverage, became more important, not less. Security programmes that waited for an AI-only threat model missed the real failure mode.

Identity hygiene must be measured as operational resilience: The market lesson is that exposed credentials, third-party-connected data stores, and weak monitoring form a repeatable breach pipeline. A mature programme has to treat credential visibility, revocation speed, and MFA coverage as resilience metrics, not just access management tasks. If those controls are not observable, they are not governable.

ULP list scale exposes a credential-economy problem: The article’s ULP discussion shows that login data is no longer just stolen, it is industrialised into a tradable commodity. That changes the governance question from how credentials are protected at issuance to how quickly they can be detected and invalidated after exposure. Practitioners need lifecycle control over exposed credentials, not just stronger password policy.

From our research library:

• 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
• Credential abuse across the entire attack chain, not just initial access, appears in 39% of all breaches, according to the 2026 Verizon Data Breach Investigations Report.
• Read next: API Key Management Guide

What this signals

Credential exposure has become a standing operational risk: The practical challenge is no longer whether credentials can be stolen, but whether they can be detected and invalidated before they are replayed. That pushes identity teams toward continuous exposure monitoring, not periodic review cycles. Use this to reset the programme conversation from password policy to credential lifecycle control.

The article also shows that AI is best understood as an amplifier of existing identity weaknesses. It increased the throughput of phishing and credential stuffing, which means the organisations most at risk are the ones still relying on reusable passwords and incomplete MFA coverage. The control gap is old, but the attack volume is now higher.

For practitioners

• Monitor exposed credentials continuously Use credential monitoring to detect when usernames and passwords appear in infostealer logs, ULP lists, or other compromise feeds, then prioritise accounts tied to external login endpoints and high-value applications.
• Reduce password reuse across user populations Enforce unique credentials, remove shared passwords where possible, and focus on accounts that can be reused across SaaS, VPN, and administrative interfaces.
• Expand MFA coverage to exposed access paths Apply MFA not only to employees but also to external access paths and high-risk applications that would otherwise accept stolen credentials as valid authentication.
• Treat third-party-connected systems as part of the identity estate Inventory customer-facing and supplier-connected environments, then assign clear ownership for credential revocation and exposure response when those systems leak data or access tokens.
• Add endpoint controls that reduce credential harvesting Use endpoint detection, application whitelisting, and email security to cut off the common delivery and collection paths that feed infostealer malware.

Key takeaways

• Credential breaches in 2025 kept following the same pattern: stolen access, reused access, and broad downstream compromise.
• The scale signal is clear from large credential dumps and repeated third-party exposure events, especially where infostealer data feeds access brokers.
• The control answer is still basic but non-negotiable: monitor exposed credentials, enforce unique logins, and close reuse paths with MFA and rapid revocation.

Key terms

• ULP List: A ULP list is a collection of URL, login, password records assembled from stolen credentials, usually harvested by infostealer malware. The URL matters because it tells an attacker exactly where the credential should work, turning a stolen secret into near-ready access material.
• Infostealer Malware: Infostealer malware is designed to quietly capture credentials, browser sessions, cookies, and other authentication artifacts from an endpoint. It creates downstream identity risk because the stolen data often remains usable even after the initial infection is removed.
• Credential Stuffing: Credential stuffing is an attack that uses stolen username and password pairs from previous breaches to try logging into other services. It works because many people reuse credentials, and because the login attempt uses valid information, it can look ordinary until the surrounding behavior gives it away.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

Deepen your knowledge

NHI governance, machine identity security, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or IAM programme maturity, it is worth exploring.