24 billion exposed credentials expose the real identity attack surface

At a glance

What this is: Securden reports that a publicly exposed repository contained roughly 24 billion previously collected credential entries, illustrating how recycled usernames, passwords, tokens, and login data now drive the identity attack surface.

Why it matters: Identity teams need to treat exposed credentials as an ongoing governance problem because a single reused secret can still enable privileged access, lateral movement, and broader compromise across human, machine, and AI identities.

Context

The core governance problem is not a one-off breach but the accumulation of exposed credentials across years of collection, resale, and reuse. In identity terms, that means organisations are defending a credential ecosystem that already exists outside their perimeter, including usernames, passwords, tokens, login URLs, and session artefacts.

For IAM and NHI programmes, the question is whether a leaked credential can still be turned into active access. If standing privilege, weak vaulting, or slow rotation remain in place, recycled credentials become a practical route into enterprise environments rather than just a hygiene issue.

The exposed repository described by Securden shows how identity risk now spans human accounts, service accounts, and machine credentials at the same time. That makes the problem as much about lifecycle governance and blast-radius control as it is about detection.

Key questions

Q: What should teams do when exposed credentials are found in a public repository?

A: Treat the repository as an entry point, not the whole incident. Revoke the exposed credential, trace every service and role it could access, and look for adjacent secrets stored in exports, configs, and workstation files. Containment has to follow the privilege graph, not just the leak location.

Q: Why do recycled credentials remain risky even when MFA is in place?

A: MFA does not remove the risk if the attacker can reuse an already valid session token, cookie, or password that was stolen elsewhere. Once a credential or session is trusted by the target system, the attacker may bypass the normal interactive login path and move straight into the account.

Q: What breaks when organisations do not have visibility into service accounts and machine credentials?

A: Without visibility, teams cannot answer who owns each identity, where it is used, or whether it still needs access. That leads to orphaned accounts, excessive permissions, failed rotations, and delayed response when a secret is exposed. The result is a larger attack surface and weaker accountability across cloud and application estates.

Q: How should security teams reduce blast radius for workload credentials?

A: Start by removing shared, long-lived secrets from the highest-risk workflows, especially API integrations, CI/CD jobs, and autonomous services. Prefer short-lived tokens, signed assertions, or runtime-attested identities so a stolen credential has limited replay value. Then align rotation, revocation, and authorisation policies so the control remains effective after deployment.

Technical breakdown

How exposed credential repositories turn into targeting tools

A large repository of stolen credentials is more than a pile of leaked data. When records are indexed and searchable, an attacker can pivot from generic exposure to targeted discovery by domain, username pattern, or privilege keywords such as admin, VPN, or root. That changes the economics of credential abuse because the attacker no longer needs to sift manually through dumps. They can query for the highest-value identities and move straight toward accounts that are more likely to have standing access or privileged reach.

Practical implication: reduce the value of exposed credential stores by revoking and rotating the secrets they surface, not just by watching for the repository itself.

Why recycled credentials still bypass modern identity controls

Modern identity attacks often begin with credentials that were stolen elsewhere. Username and password pairs, session cookies, authentication tokens, and browser-stored login data can all carry enough trust to bypass the first layer of security if they are still valid. That is why MFA alone does not end the problem when an attacker can reuse an already authenticated session or a token that was never invalidated. The issue is not only authentication strength, but also credential lifetime and session invalidation discipline.

Practical implication: align token, cookie, and password lifetimes with revocation processes so reused credentials expire before they can be abused.

How standing privilege converts exposure into breach impact

Once a compromised credential works, the next stage is usually privilege escalation or lateral movement. Standing access makes that progression easier because the attacker does not need to wait for approval or request fresh rights. In cloud-first environments, the blast radius of a single identity can include admin consoles, SaaS tooling, developer platforms, and machine-to-machine trust paths. That is why identity governance has become the control plane for breach containment: if access is persistent, a stolen credential has far more time to be useful.

Practical implication: map which identities still hold standing privilege and remove those paths before a recycled credential is tried.

Threat narrative

Attacker objective: The objective is to turn recycled credentials into live access that can be used for privilege escalation, lateral movement, and broader compromise.

1. Entry begins when an attacker obtains reusable credentials from a publicly exposed repository built from infostealer logs, breach dumps, Telegram channels, and leak collections.
2. Credential use follows when usernames, passwords, session tokens, or browser cookies are replayed against live services that still trust them.
3. Escalation occurs if the compromised identity has standing privileges or access to privileged tools, letting the attacker expand beyond the first account.
4. Impact is achieved when that access is used to search, copy, or weaponise other exposed identities and privileged logins across the environment.

Breaches seen in the wild

• MongoBleed breach: MongoBleed exposed secrets across 87K MongoDB servers.
• EmeraldWhale Git config credential theft: Tokens in exposed .git/config files let EMERALDWHALE clone private repositories and steal more than 15,000 cloud credentials.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Credential reuse is now the dominant identity attack surface: The article shows that attackers increasingly rely on credentials already circulating in the wild instead of stealing new ones. That shifts the governance problem from isolated breach response to continuous control over secret lifetime, exposure monitoring, and revocation scope. The practitioner conclusion is that every exposed credential must be treated as a live access event until proven otherwise.

Standing privilege turns recycled secrets into enterprise compromise: A reused password is dangerous only if the identity behind it can still reach something valuable. This is why vaulting, rotation, and just-in-time access matter as containment controls, not just hygiene controls. The practitioner conclusion is that blast-radius reduction is the real metric, because the same exposed secret is either noise or breach fuel depending on entitlement design.

Identity blast radius is the right concept for this problem: The article is really describing how one leaked credential can fan out across human, machine, and AI-connected systems when governance is fragmented. That makes identity lifecycle discipline a cross-domain control problem rather than a password problem. The practitioner conclusion is to manage exposure as a lifecycle and privilege issue, not as a one-time detection event.

Service-account governance remains a blind spot: Only 5.7% of organisations have full visibility into their service accounts, which means many teams still cannot confidently answer which non-human identities are exposed, stale, or overprivileged. That gap matters because machine credentials are now part of the same reused-credential economy as human logins. The practitioner conclusion is that service-account inventory and offboarding must be treated as breach prevention controls.

Searchable exposure changes attacker economics: A searchable repository reduces the cost of finding high-value identities by domain or role, which means defenders are no longer only racing attackers to initial compromise. They are racing the index. The practitioner conclusion is that exposed secrets, tokens, and login artefacts need faster invalidation than the reuse cycle that adversaries exploit.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: Ultimate Guide to NHIs — Key Research and Survey Results

What this signals

Identity blast radius: The useful question is not whether credentials will leak, but how far a leaked credential can travel before it is invalidated. Programmes that still treat passwords, tokens, and service-account secrets as isolated items miss the bigger control problem, which is entitlement persistence across the identity estate.

The 5.7% visibility figure for service accounts is a warning sign for every IAM and NHI team. If you do not know where non-human credentials live, you cannot reliably rotate them, revoke them, or prove that standing privilege has been removed before an exposure becomes operationally useful.

For practitioners

• Inventory exposed credential sources Build an inventory of where reused credentials can appear, including breach data, infostealer logs, leak repositories, and collaboration channels that surface login artefacts. Prioritise the sources that are indexed and searchable, because those are easiest to operationalise for attackers.
• Remove standing access paths Identify accounts, service accounts, and tokens that still work without a fresh approval step and remove those persistent rights. Focus first on identities that can reach privileged consoles, developer systems, and cloud administration paths.
• Shorten secret lifetime Rotate passwords, API keys, tokens, and session-bearing credentials aggressively enough that any credential leaked from an external repository is likely to be expired before reuse. Pair rotation with revocation so old values cannot continue to authenticate.
• Hunt for privileged exposure Search for accounts hidden in exposed datasets by using privilege keywords, domain names, and role labels to locate the identities most likely to lead to lateral movement. Escalate any match that maps to admin, VPN, root, or similar access paths.

Key takeaways

• The article describes a large-scale credential exposure problem, not a single-breach event, and the real risk is reuse of already circulating secrets.
• Scale matters because the exposed repository was searchable and contained billions of records, which makes targeted identity discovery much easier for attackers.
• The practical control question is whether standing access, weak visibility, and slow rotation let one exposed credential become a broader compromise.

Key terms

• Credential Reuse: Credential reuse happens when the same password, token, or secret can unlock multiple systems or sessions. It increases breach impact because one stolen credential can become a wide-ranging access path. The control problem is not only theft, but the amount of trust packed into each reusable secret.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Service account visibility: The ability to discover, attribute, and review non-human accounts across an environment. For NHI governance, visibility includes owner mapping, permission history, and lifecycle state so that access is not left to drift in legacy or private systems.

Deepen your knowledge

NHI governance, machine identity security, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.