Identity breaches and help desk hijacks are escalating globally

At a glance

What this is: RSA Security's latest global survey shows identity breaches rising sharply, with help desk bypass attacks and higher breach costs emerging as the most visible warning signs.

Why it matters: IAM, PAM, and identity governance teams need to treat service desk abuse, passwordless adoption gaps, and breach-cost escalation as connected control problems rather than separate programmes.

By the numbers:

• 69% of organisations experienced an identity-related breach in the last three years.
• 45% of organisations said that the cost of an identity-related breach exceeded the typical cost of a breach.
• 24% of organisations said identity-related breach costs exceeded $10M.

Context

Identity breaches are no longer just authentication failures. They now show up as operational disruption, financial loss, and governance gaps when attackers abuse trusted identity paths such as help desks, service desks, and recovery workflows.

RSA Security's 2026 RSA ID IQ Report surveys more than 2,100 cybersecurity, IAM, and IT professionals, and it places identity risk at the centre of breach frequency, breach cost, and user-authentication strategy. The article also points to passwordless adoption progress, AI expectations, and regional differences in Brazil as part of the same control picture.

Key questions

Q: What breaks when help desk recovery processes are easier to abuse than primary authentication?

A: When recovery is easier to manipulate than login, attackers bypass the strongest control and go after the weakest trust decision. That lets social engineering or caller fraud turn support staff into the enforcement layer for account takeover, including privileged accounts. The result is broader compromise, because identity recovery becomes the shortest path into the environment.

Q: Why do identity-related breaches become so expensive so quickly?

A: Identity compromise often gives attackers legitimate access rather than a narrow technical foothold. That access can reach email, SaaS administration, cloud consoles, and business systems, which expands containment, investigation, and notification costs. The financial impact usually comes from blast radius, not from the first account alone.

Q: What are the signs that help desk security controls are failing?

A: Warning signs include undocumented support actions, excessive help desk entitlements, exceptions handled outside normal change management, and requests approved without out-of-band verification. Another signal is when staff feel pressure to bypass process for VIPs or urgent cases. Those patterns show the support workflow is operating on assumption rather than controlled identity checks and auditable process.

Q: Should organisations prioritise recovery design or new authentication factors first?

A: Recovery design usually comes first because a weak recovery path can undermine a strong factor. If users can re-enter the environment through interceptable OTP flows or inconsistent manual resets, the new method does not change the underlying exposure surface.

Technical breakdown

Why help desk bypass attacks work

Help desk hijacks succeed because support processes often rely on weak human verification, fast-path exception handling, and incomplete caller provenance. Attackers do not need to defeat core authentication if they can persuade support staff to reset access, override controls, or rebind credentials. In practice, the trust boundary sits in the service desk workflow, not the login screen. That makes account recovery and support authentication part of the identity attack surface, especially where privileged accounts or SSO recovery are involved.

Practical implication: Treat help desk identity proofing and recovery as high-risk authentication paths, not administrative convenience.

What identity-related breach cost tells you about governance failure

When identity-related incidents cost more than typical breaches, the issue is usually not just access compromise. It is broader blast radius: privileged access, delayed detection, weak segmentation of identity controls, and slow containment across cloud, SaaS, and on-premises systems. Cost escalation also suggests that identity governance did not contain the initial account abuse quickly enough to prevent downstream impact. Breach cost is therefore a governance signal as much as a financial outcome.

Practical implication: Measure identity control effectiveness by containment speed and scope reduction, not only by login success rates.

Why passwordless progress and breach pressure belong in the same conversation

Passwordless adoption reduces some credential risk, but it does not remove the need for identity proofing, recovery controls, and governance over fallback paths. Organisations can still fail through account recovery, device binding, help desk escalation, or weak federation recovery if those workflows remain easier to abuse than primary sign-in. The article's global survey data shows that identity teams must govern the full authentication journey, not just the primary login method.

Practical implication: Review fallback and recovery paths alongside passwordless rollout, because attackers often target the weakest alternate route.

Threat narrative

Attacker objective: The attacker wants trusted access that can be converted into broad account takeover, data theft, and operational disruption without needing to break the primary login layer.

1. Entry occurs through social engineering or service-desk bypass, where attackers target recovery and reset workflows instead of primary authentication.
2. Credential or access escalation follows when support staff or weak proofing processes grant account control, often including privileged identities or SSO-linked access.
3. Impact comes from broader identity compromise, including data theft, operational disruption, and materially higher breach costs once attackers can move across connected systems.

Breaches seen in the wild

• Caesars Entertainment breach 2023: Social engineering of an IT support vendor let attackers copy Caesars loyalty database; about $15 million was reportedly paid.
• Co-op cyber attack 2025: Attackers linked to Scattered Spider tricked their way into a Co-op employee account and stole personal data of all 6.5 million members.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity governance is now a breach-cost control, not just an access-control discipline. The report links identity failure to both higher breach frequency and higher breach cost, which means governance gaps now translate directly into financial exposure. The practical issue is no longer whether identity is central to security, but whether the programme can reduce blast radius when identity fails. Leaders should treat identity outcomes as resilience metrics, not only compliance artefacts.

Help desk workflows have become a primary identity attack surface. The article shows that organisations now see service desk bypass as a top threat because recovery and support processes can be manipulated into granting access. That shifts attention away from the login event and toward the human process that reissues trust. Teams need to regard recovery paths as governed identity controls, not support shortcuts.

Passwordless progress does not eliminate the recovery problem. Even where passwordless adoption advances, attackers can still target fallback verification, device reset, and account recovery flows. The security model only improves if alternate paths are governed with the same rigour as primary authentication. Practitioners should measure the security of the fallback path, not just the strength of the main sign-in experience.

Brazil's passwordless lead shows adoption can outpace governance if recovery is left unchanged. A region can move faster on primary authentication while still carrying legacy recovery assumptions into the rest of the identity estate. That creates a split model where modern login methods coexist with older trust decisions in support and federation workflows. The lesson is that authentication modernisation must be matched by lifecycle and recovery governance.

Identity breach blast radius: The article's most important signal is that identity incidents now compound across systems, which makes breach cost the clearest indicator of whether governance is working. If identity controls cannot stop one trusted credential path from becoming a broad compromise, the programme is measuring activity rather than resilience. Practitioners should focus on containment scope, not just authentication coverage.

From our research library:

• 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
• Read next: Account Recovery and Help Desk Security Guide

What this signals

Identity breach blast radius is now the metric that matters. Security teams should stop treating authentication success as proof that identity is well governed. The more useful question is whether a compromised identity can be contained before it cascades into recovery abuse, privilege expansion, and business interruption.

Help desk security must be pulled into the identity operating model. The article reinforces a simple governance reality: support workflows are not peripheral service processes, they are identity issuance and recovery points. That means service desk policy, proofing, and escalation need the same audit attention as provisioning and access review.

Passwordless adoption only reduces risk if fallback logic is equally controlled. The authentication experience may improve, but the identity programme still fails if reset paths, re-enrolment, and privileged support handling remain soft spots. Practitioners should judge progress by how hard it is to abuse the weakest alternate route.

For practitioners

• Harden service desk identity proofing Require stronger verification for resets, rebinds, and account recovery, especially where privileged or federated identities are involved. Remove informal exceptions that let support staff shortcut caller validation.
• Map and govern fallback authentication paths Document every alternate route into an account, including recovery codes, device resets, and support-assisted re-enrolment. Apply the same control ownership and approval standards you use for primary login.
• Measure breach containment by identity path Track how quickly a suspected identity compromise can be isolated across SSO, help desk, and downstream applications. Use that containment view to judge whether governance is actually reducing blast radius.
• Prioritise passwordless with recovery controls Treat passwordless deployment and recovery hardening as one programme, not two. If fallback verification remains weak, the attacker will go after the weakest supported path instead of the strongest sign-in method.
• Review privileged account support handling Separate elevated account workflows from standard service desk processes and require tighter escalation controls before any reset or recovery action is approved.

Key takeaways

• Identity breaches are rising fast enough that they now represent a recurring governance and resilience problem for security teams.
• Help desk and service desk abuse has become a central attack path because it lets attackers bypass the primary login layer through social engineering.
• The most effective response is to harden recovery, escalation, and fallback paths so one compromised identity cannot become a broad enterprise incident.

Key terms

• Identity-Related Breach: An identity-related breach is an incident where stolen, abused, or over-permissioned identities are the main path to compromise. These events often bypass traditional perimeter defenses because the attacker is not breaking in technically, but logging in with a credential that the system still trusts.
• Help desk bypass attack: A help desk bypass attack is social engineering aimed at support staff or recovery workflows so the attacker can override normal authentication or account controls. These attacks matter because the service desk can become an alternate trust channel that is easier to influence than the primary login system.
• Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.
• Recovery Workflow: A recovery workflow is the sequence of checks and actions used to restore access after a credential issue or account lockout. It includes verification, credential issuance, synchronization, and audit logging. Weak recovery workflows are attractive to attackers because they often sit outside the strongest authentication controls.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.