TL;DR: A May 2025 breach exposed over 184 million plaintext login credentials across Google, Apple, Microsoft and other services after infostealer malware fed data into an unsecured ElasticSearch server, according to Unixi, including banking, government and healthcare accounts in more than 29 countries. Password-based IAM is no longer a complete control when browsers, tokens, cookies and shadow SaaS expand the attack surface beyond the identity provider.
At a glance
What this is: A May 2025 breach exposed more than 184 million plaintext login credentials across major consumer and enterprise platforms, showing how infostealer-driven collection and weak storage can overwhelm password-based security.
Why it matters: IAM teams need to treat passwords, session artefacts and unmanaged SaaS access as one control problem, because compromise now arrives through multiple identity layers rather than a single login flow.
By the numbers:
- In May 2025, a massive Google and Apple data breach exposed over 184 million login credentials.
- The compromised accounts included data from over 29 countries.
Context
Passwords fail as a security boundary when they are copied out of browsers and endpoints before authentication even begins. In this case, the breach was not limited to one provider or one sector, because the exposed data spanned consumer platforms, enterprise services and sensitive government and healthcare accounts.
The identity governance problem is broader than password hygiene. When session cookies, tokens and unmanaged SaaS applications sit outside central policy, the identity provider no longer sees the full credential estate or the full blast radius of compromise.
This is a classic shadow access problem: organisations may believe they have SSO coverage, while users still authenticate through local browser stores, unsanctioned apps and weakly governed endpoints. That gap is now common, not exceptional.
Key questions
Q: What breaks when malware steals passwords and browser data at scale?
A: What breaks is the assumption that a credential is only dangerous while the infected device is still active. Once passwords, browser artefacts, and wallet secrets are harvested, attackers can replay them elsewhere, often outside the original victim environment. That means containment has to include revocation, reset, and reuse detection, not just endpoint cleanup.
Q: Why do browser cookies and session tokens increase account takeover risk?
A: They can preserve authenticated access even after a password changes, which means the stolen session may remain usable until it expires or is explicitly revoked. That is why compromise response must include session invalidation, not just credential resets. Browser-stored access state should be treated as live identity material.
Q: How should security teams govern shadow IT in SaaS environments?
A: Security teams should govern shadow IT by treating it as unmanaged access, not just unsanctioned software. Start with continuous discovery, then map each app to owners, data types, delegated scopes, and revocation paths. The control goal is to reduce hidden access paths before they become business-critical dependencies.
Q: What should organisations do when password-based IAM no longer covers the full SaaS stack?
A: Organisations should reduce dependence on locally stored secrets, tighten endpoint protection and extend identity governance to the long tail of browser apps. Where federation is unavailable, they need compensating controls that limit credential reuse and make revocation immediate and visible.
Technical breakdown
How infostealer malware turns browser storage into credential inventory
Infostealer malware is designed to harvest saved credentials, session cookies, autofill data and browser metadata from endpoints without user awareness. Once collected, the data can be staged on an external server for resale or reuse. The critical failure here is not just malware execution, but the absence of endpoint containment and credential compartmentalisation, which allows browser state to become a portable identity vault. Plaintext storage makes the problem worse because the attacker does not need to crack hashes or bypass encryption; the credential is already usable. This is why password security has to be treated as an endpoint and lifecycle problem, not only an authentication problem.
Practical implication: reduce browser-stored credential exposure and treat endpoint compromise as credential compromise.
Why plaintext credentials and session cookies bypass classic password controls
Traditional IAM assumes the password is the primary secret and that MFA can contain the damage if the password leaks. That assumption breaks when attackers steal session cookies, access tokens or other bearer artefacts that authenticate without re-entering a password. A cookie or token can often outlive the original login and may bypass step-up checks entirely if the session is trusted. In other words, the control plane is not only the password verifier, but also the lifecycle of session state. If token issuance, refresh and revocation are not centrally governed, passwordless migration alone will not close the exposure path.
Practical implication: govern session artefacts with the same discipline used for primary credentials and revocation.
Why shadow SaaS widens the identity perimeter beyond the IdP
Shadow SaaS refers to browser-based applications that users access outside sanctioned onboarding, lifecycle and policy controls. These apps may not support SAML, SCIM or centralised federation, which forces users into locally stored credentials or ad hoc authentication paths. From a governance standpoint, the problem is not only unknown applications, but unknown identity pathways. If the identity team cannot enumerate where credentials live, who owns them and how they are revoked, then SSO coverage is partial by definition. That makes the control boundary porous even when the core enterprise stack is well governed.
Practical implication: inventory browser-based SaaS access paths, not just federated applications.
Threat narrative
Attacker objective: The objective is large-scale reuse of stolen identity data for account takeover, fraud and downstream access abuse.
- Entry occurred when infostealer malware harvested saved credentials, cookies and metadata from browsers and devices.
- Credential access expanded as plaintext usernames and passwords were uploaded to an unsecured ElasticSearch server with no access control.
- Impact followed through reuse of the exposed data across consumer, enterprise, banking, government and healthcare accounts in multiple countries.
Breaches seen in the wild
- Firebase misconfiguration exposure 2024: Missing Firebase security rules on 916 websites exposed 125 million user records and 19.87 million plaintext passwords; a quarter were fixed.
- Amazon AWS Hacked Accounts Crypto-Mining: Compromised IAM credentials across multiple AWS accounts fuel large-scale crypto-mining campaign.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Plaintext credential exposure is not a password problem, it is an identity lifecycle failure: The breach worked because credentials were harvested, stored and redistributed outside any governed lifecycle boundary. Password-centric programmes assume the secret remains under policy until authentication time, but browser storage and unprotected servers break that assumption. The practitioner conclusion is clear: control has to follow the credential after issuance, not just at login.
Session artefacts are now part of the credential estate: Cookies, tokens and other bearer artefacts can invalidate the protection model even when MFA exists. They create a parallel authentication path that is often invisible to classic password controls and recertification workflows. For IAM leaders, the unit of governance has expanded from password to authenticated session, and that changes how exposure is measured and contained.
Shadow SaaS creates a governance blind spot that SSO alone does not solve: Organisations can have federation for core systems and still leave a long tail of browser apps outside policy. Those apps often store local credentials, bypass provisioning and evade revocation, which means access exists without durable ownership. The practitioner conclusion is to treat unmanaged SaaS as governed identity inventory, not as a user convenience issue.
Traditional least-privilege assumptions are too static for modern credential sprawl: Least privilege was designed for identities with known scopes and visible enforcement points. That assumption fails when the same user, browser and endpoint can mint, cache and replay secrets across dozens of services outside central control. The implication is not simply more tooling, but a redefinition of what privilege evidence looks like in the browser age.
Credential blast radius is now the decisive metric: One leaked password no longer describes one affected account when session tokens, cookies and synced browser state travel with it. The real governance question is how far a single endpoint compromise can propagate across enterprise and personal services. Practitioners should therefore judge controls by how sharply they constrain downstream reuse.
From our research library:
- The average user manages 70 to 100 passwords, many of them outside centralised identity platforms.
What this signals
Credential blast radius: organisations need to measure not only how many passwords are exposed, but how far one endpoint compromise can travel through cookies, tokens and local browser stores. That broader blast radius is what turns a single infostealer infection into multi-platform identity exposure.
The practical response is to move governance closer to the browser and the device, because centralised SSO does not control every authentication path users actually take. Teams that still treat password theft as a login problem will keep underestimating the real exposure window.
For practitioners
- Inventory browser-stored credentials Map which endpoints, browsers and managed devices store usernames, passwords, cookies and tokens, then identify where those secrets can be copied or synced outside policy.
- Reduce standing value in session artefacts Shorten session lifetimes, revoke bearer tokens aggressively after suspicious activity, and ensure refresh paths do not preserve access longer than the risk window allows.
- Bring shadow SaaS into identity governance Classify browser-based apps that sit outside SAML or SCIM coverage, assign ownership for each one and define how access is discovered and revoked.
- Harden endpoints against infostealer campaigns Prioritise endpoint controls that block credential theft at the browser and device layer, because once local stores are harvested the identity provider is already too late.
- Test phishing-resistant authentication coverage Validate where FIDO2 or WebAuthn is actually enforced and where password fallback still exists, especially for high-risk accounts and unmanaged SaaS.
Key takeaways
- This breach shows that password controls alone cannot contain identity compromise when browser storage, tokens and shadow SaaS are part of the attack surface.
- The scale matters because the exposed dataset crossed consumer, enterprise and regulated accounts, which raises the likelihood of reuse across multiple environments.
- The limiting control is not just stronger passwords but tighter governance of endpoints, session artefacts and unmanaged applications.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | The article centers on leaked plaintext credentials and other exposed secrets. |
| NHI-07 — Long-Lived Secrets | Stolen credentials and sessions remain useful long after initial collection. | |
| NHI-10 — Human Use of NHI | Browser-stored secrets and unmanaged SaaS show humans using machine-authenticated access paths. | |
| Recommendation — Scan for exposed NHI secrets and revoke any credentials found in insecure storage immediately. Shorten secret and session lifetimes so compromised credentials cannot be reused for long. Separate human login flows from machine-style credentials and remove local secret reuse. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Authenticator lifecycle and revocation are central when leaked credentials remain exploitable. |
| Recommendation — Apply authenticator management controls to rotate, revoke and track exposed credentials. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about governing access scope across unmanaged and federated services. |
| Recommendation — Review entitlements across browser apps and revoke access paths that lack clear ownership. | ||
| MITRE ATT&CK | TA0006;TA0001 — Credential Access; Initial Access | Infostealer collection followed by credential reuse is the core attack pattern here. |
| Recommendation — Map infostealer activity to credential access and hunt for endpoints showing secret harvesting. | ||
Key terms
- Infostealer Malware: Infostealer malware is designed to quietly capture credentials, browser sessions, cookies, and other authentication artifacts from an endpoint. It creates downstream identity risk because the stolen data often remains usable even after the initial infection is removed.
- Shadow SaaS: Shadow SaaS is the set of unauthorised or unreviewed software-as-a-service tools used outside central security governance. These applications often bypass normal identity controls, making them difficult to inventory, monitor, and harden against credential-based abuse.
- Session artefacts: Temporary access material such as active login sessions, cookies, tokens, and cached credentials that prove trust without requiring the original password again. These artefacts are often the shortest path from endpoint compromise to cloud or SaaS account abuse.
- Credential Blast Radius: Credential blast radius is the amount of access, data, and system reach that a single compromised secret can unlock. The wider the blast radius, the more damage one leaked token or certificate can cause. Reducing it requires tighter scope, faster revocation, and better segmentation.
Deepen your knowledge
NHI governance, machine identity security, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on August 2, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org