Credential abuse is driving this week’s breach pattern

At a glance

What this is: This weekly intelligence report says the dominant breach pattern was credential abuse and valid-account misuse, not malware, across major public incidents and claims.

Why it matters: It matters because IAM, PAM, and NHI teams need to treat access paths, authentication friction, and external exposure as active attack surfaces, not administrative plumbing.

By the numbers:

• The week of 17 to 23 August 2026 was defined by stolen and sprayed credentials doing the work that malware used to do.
• The Hatman claimed 3.64 million employee records stolen from Fortune 500 Azure tenants.

👉 Read FireCompass's weekly cybersecurity intelligence report on credential abuse and breaches

Context

Credential abuse is now a primary intrusion path because attackers can often achieve their objective without deploying malware at all. When sprayed passwords, replayed sessions, or stolen access tokens are enough to reach data and administration surfaces, the security problem shifts from malware detection to identity assurance, access-path inventory, and containment of valid accounts.

This week’s reporting spans government, higher education, and enterprise cloud tenants, but the common issue is the same: organisations are still defending perimeter entry while attackers are using legitimate access points already exposed to the internet. For IAM and NHI programmes, that means the question is no longer whether credentials are protected in theory, but whether every account, tenant, and access path can withstand attacker pacing in practice.

Key questions

Q: What breaks when organisations rely on valid accounts as a security boundary?

A: The boundary breaks because valid access can be abused without triggering classic exploit detection. Once an attacker has a live account, the next stage is often data access or administrative misuse, not malware execution. Security teams need to watch what a successful login can do, because authentication success is not the same as trust.

Q: Why do sprayed passwords and MFA fatigue still work against cloud tenants?

A: They work because many environments still allow repeated authentication attempts against internet-facing identities and rely on human-paced approval flows. Attackers operate faster than review cycles and can exploit legacy paths, weak recovery, or push-based MFA habits. That makes tenant hardening and phishing-resistant factors essential, especially for privileged accounts.

Q: How should security teams handle credential abuse when breaches look like system intrusion?

A: They should treat credential abuse as an identity failure, not just an intrusion category. Successful logins can still be malicious if the account, device, or context is wrong. Security teams need correlation across identity, privilege, and behavior so that stolen credentials, unauthorized access, and privilege misuse are investigated as one problem, not separate ones.

Q: What should organisations prioritise first in identity governance?

A: Organisations should prioritise the highest-cost access problems first: orphaned accounts, excessive privilege, and manual review bottlenecks. Those issues generate both breach risk and operating cost. Start where access cannot be explained cleanly, because unexplained access is usually where governance work, audit delay, and incident scope expand fastest.

Technical breakdown

Valid accounts as the initial access vector

MITRE ATT&CK treats valid-account abuse as a distinct intrusion pattern because the attacker does not need to break the authentication system once credentials are obtained or guessed. Password spraying, MFA fatigue, and stolen tokens all convert trust in the login path into access. In cloud and SaaS environments, that access can be enough to reach mailbox data, identity admin functions, or exportable records without touching endpoint malware. The practical effect is that authentication telemetry alone is insufficient if it is not paired with session risk, tenant exposure, and privilege scope analysis.

Practical implication: monitor for valid-account abuse as a first-class attack path, not just as a failed-login problem.

Why external access points become breach amplifiers

The report shows that attackers repeatedly rely on externally reachable paths that organisations already expose for business use: tax portals, tenant logins, VPNs, and administrative interfaces. Once those paths are reachable from the internet, the attacker’s advantage is pacing. They can test credentials at scale, pause between attempts, and exploit any weak recovery path or legacy authentication method that still bypasses modern controls. The problem is not only exposure, but untested exposure under attacker conditions.

Practical implication: inventory every internet-facing access point and test it from the attacker’s side, including recovery and legacy paths.

Cloud tenant compromise and identity blast radius

The Azure tenant story illustrates how a single compromised identity path can expose large record sets across multiple organisations when identity governance is weak. The blast radius is determined by entitlement breadth, tenant trust relationships, and how much can be exported before detection. This is where NHI and IAM converge: service principals, admin accounts, and delegated access paths behave like high-value identities when they can be used to query or extract at scale. The failure is not only credential theft, but excessive trust in what one account can reach.

Practical implication: shrink tenant blast radius by revalidating delegated access, export rights, and admin scopes before the next attack wave.

Threat narrative

Attacker objective: The attacker objective was to turn legitimate access into scalable data theft or operational disruption without relying on malware.

1. Entry began with sprayed passwords, stolen credentials, or purchased footholds that let attackers authenticate as legitimate users.
2. Escalation followed through MFA fatigue, legacy paths, or overbroad tenant permissions that expanded what a valid account could read or export.
3. Impact came from bulk data extraction, operational disruption, and large-scale exposure across public sector and enterprise environments.

Breaches seen in the wild

• Salesloft OAuth token breach — hackers stole OAuth tokens to access Salesforce data via Salesloft.
• GitHub Dependabot Breach — GitHub Dependabot tokens stolen and abused to push malicious commits to repositories.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Credential abuse is now the dominant breach primitive, not an edge case. This week’s reporting shows that attackers can achieve data theft, tenant compromise, and service disruption using valid credentials, sprayed passwords, or fatigued MFA alone. That means defenders are no longer dealing with a malware-first threat model. The practitioner conclusion is that identity assurance has become the primary control boundary.

Standing trust in externally reachable accounts creates a measurable identity blast radius. When a single account can export records, traverse tenant data, or trigger administrative workflows, the security question shifts from login success to consequence size. This is an NHI and IAM governance issue at the same time because service accounts, admin users, and delegated tenant identities are all part of the same exposure surface. Practitioners should treat every externally reachable identity as a potential collection path, not a simple access mechanism.

Credential spraying remains effective because many programmes still optimise for user convenience over attacker pacing. The report’s Azure and university examples show that short bursts of automated login attempts can outpace periodic review and weak second-factor friction. The relevant control gap is not a missing policy statement, but a mismatch between review cadence and attack cadence. The practitioner conclusion is that authentication design must assume attacker repetition, not human inconvenience.

Valid accounts collapse the distinction between authentication and compromise. Once an attacker reaches a live account, detection based only on anomalous logins arrives too late to prevent bulk read or export activity. That makes least privilege and session monitoring more important than static perimeter controls. Practitioners should reframe identity governance around what a valid session can do, not only how a login occurred.

Identity-centric threat intelligence now belongs in board reporting. The week’s incidents show that access abuse can disrupt government services, delay academic operations, and expose millions of records without a traditional exploit chain. This is why identity risk should be measured alongside vulnerability management and endpoint telemetry. The practitioner conclusion is that breach readiness now depends on knowing which identities can move data at scale.

From our research:

• The average organisation believes more than 1 in 5 of their non-human identities are insufficiently secured, according to The 2024 ESG Report: Managing Non-Human Identities.
• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirming it and 26% suspecting it.
• That pattern makes Ultimate Guide to NHIs , Key Challenges and Risks the natural next step for teams reassessing identity exposure.

What this signals

Credential abuse and NHI exposure are converging. As attackers increasingly rely on valid access paths rather than malware, the governance problem extends beyond human logins into service accounts, tokens, and delegated identities. With 72% of organisations reporting or suspecting an NHI breach in our research, the operational issue is not whether identity is part of the attack path, but whether the programme can distinguish trusted automation from exploitable access. Top 10 NHI Issues is the right lens for sorting that exposure.

Identity teams should expect more incidents where the first visible symptom is data movement, not compromise of an endpoint or server. That means audit, export monitoring, and access-path discovery need to sit alongside MFA hardening and password spray detection. The practical signal is simple: if the account can read or export at scale, attacker value scales with it. OWASP Non-Human Identity Top 10 remains the most relevant external reference for the underlying NHI control set.

For practitioners

• Map externally reachable identity surfaces Inventory every internet-facing login, recovery, federation, API, and admin path, then test them from the attacker’s side for sprayed credentials and legacy authentication bypasses.
• Harden privileged tenant authentication Replace push-based approval on privileged cloud accounts with phishing-resistant factors and block legacy paths that accept weaker second-factor handling.
• Reduce export and read blast radius Review which accounts can bulk read, export, or delegate access in each tenant, and remove broad collection rights from identities that do not need them.
• Validate detection against attacker pacing Run password spray simulations and bulk-read tests at the speed attackers use, then tune alerts for repeated authentication attempts and high-volume exports per account.

Key takeaways

• This weekly report shows that credential abuse, not malware, is now the default starting point for many public breaches and claims.
• The evidence includes 678,000 exposed tax records, 3.64 million claimed Azure tenant records, and multiple identity-led attack paths across sectors.
• Security teams should respond by inventorying access points, hardening privileged authentication, and shrinking the blast radius of every account that can read or export data.

Key terms

• Valid accounts: Legitimate credentials, tokens, or identities that an attacker uses to authenticate normally. The danger is not the login method itself, but that trusted access can be abused without triggering many traditional malware or perimeter alerts.
• Password Spraying: A guessing technique that uses a small set of common passwords against many accounts to avoid lockouts and detection. It is effective when organisations do not reject common passwords, do not monitor patterns across identities, or allow too much standing access.
• MFA Fatigue: MFA fatigue is the behavioural pressure created when repeated login prompts make a person more likely to approve access without checking carefully. It is a control failure in the authentication experience, and it becomes dangerous when the approved session carries broad privilege or long-lived access.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

What's in the full article

FireCompass's full blog post covers the incident-by-incident operational detail this post intentionally leaves for the source:

• Per-incident breakdowns of the DGFiP, Azure tenant, UTSA, Medusa, and DOJ stories with source-by-source context
• FireCompass's remediation guidance on external attack surface validation and identity-focused response sequencing
• The full attack-path discussion behind password spraying, MFA fatigue, and valid-account abuse across multiple sectors
• CISO-oriented commentary on what this week's incidents imply for continuous testing and access control priorities

👉 FireCompass's full report includes the incident detail, attacker techniques, and response guidance behind this week's identity-led breach pattern.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.