IoT breaches in 2025-2026 show how exposed devices scale attacks

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Asimily's blog post: Biggest IoT cybersecurity breaches of 2025 and 2026 show how botnets, exposed data stores and vulnerable management platforms keep turning connected devices into attack infrastructure.

Why it matters: It matters because IoT security is now an identity and governance problem as much as a device problem, with default credentials, unmanaged access paths and weak segmentation creating enterprise-wide exposure.

By the numbers:

• SonicWall recorded a 124% year-over-year increase in IoT attacks in 2024.
• In March 2026, four IoT botnets had collectively infected more than 3 million devices.
• The connected device population reached 21.1 billion globally at the end of 2025.
• The article says the connected device population is projected to hit 39 billion by 2030.

Context

IoT security is about controlling a fast-growing population of connected devices that often cannot run full agents, are shipped with weak defaults, and sit in networks that were not designed for hostile traffic. That combination makes them attractive to both botnet operators and intruders looking for a low-friction foothold.

The article shows that the problem is not confined to consumer gadgets. Enterprise management platforms, exposed databases and camera fleets can all become operational or identity-control risks when inventory, segmentation and credential hygiene lag behind deployment.

Key questions

Q: What breaks when IoT devices rely on default credentials and weak onboarding?

A: Default credentials and weak onboarding create a reusable foothold that attackers can automate at scale. Once a device is enrolled into hostile infrastructure, it can be repurposed for DDoS, proxy abuse or internal reconnaissance. The core failure is not just compromised hardware, but the absence of durable identity controls that bind each device to a known owner, state and access boundary.

Q: Why do unmanaged home devices increase enterprise risk so quickly?

A: Unmanaged home devices often lack corporate hardening, consistent monitoring, and centrally enforced access controls. That makes them weaker entry points for malware, credential theft, and session hijacking. Once they are used to access company data or infrastructure, the organisation inherits the risk of the device without inheriting the controls that should have protected it.

Q: What are the signs that IoT segmentation is failing in practice?

A: Warning signs include camera traffic that suddenly scans subnets, talks to new internal hosts, or reaches services outside its normal video-management path. Another signal is when segmentation depends on exceptions, manual ACL growth, or MAC-based NAC workarounds. Those patterns show that policy is being maintained by memory and process rather than enforced by the network.

Q: Should organisations trust new IoT devices before they are fully verified?

A: No. New IoT devices should be treated as untrusted until they pass identity assignment, integrity verification and network placement controls. Pre-infected supply chains and first-boot payload delivery mean sealed hardware can still be compromised. Trust should be earned through evidence, not assumed from packaging, purchase channel or vendor reputation alone.

Technical breakdown

How IoT botnets turn weak device identity into scale

Botnets succeed when devices can be repeatedly recruited with little cost to the attacker. In this article, default credentials, infrequent firmware updates and weak device visibility create a durable pool of candidates for compromise. Once infected, routers, cameras and DVRs become part of a command-and-control mesh that can be instructed to launch distributed denial-of-service traffic, proxy abuse or secondary scanning. The technical issue is not just malware execution, but the absence of a trust boundary around the device itself. When device identity is weak or never verified, every new deployment expands the attacker's available fleet. See the Device and IoT Identity Guide.

Practical implication: Treat every unmanaged connected device as a potential persistent access path and require authenticated onboarding plus segmentation before production use.

Why exposed cloud data and management planes widen IoT blast radius

IoT risk does not stop at the endpoint. Device telemetry, credentials and administrative control planes often live in cloud databases and management platforms that are easier to expose than the devices themselves. When those systems are publicly reachable or insufficiently authenticated, an attacker can pivot from device compromise to fleet-wide control, or directly harvest sensitive data tied to devices and users. In the HPE OneView case, exploitation of a centralized infrastructure platform created leverage across a much wider environment than a single device. That is why IoT governance must include the data path and the management plane, not just the hardware.

Practical implication: Review every IoT management and telemetry system as privileged infrastructure and apply the same access controls you would use for administrative identity systems.

How supply chain compromise makes new devices untrustworthy by default

A pre-infected device changes the security model because the compromise exists before the buyer has any chance to inspect or harden it. The BadBox 2.0 case shows three infection paths: malware present before purchase, payloads retrieved on first boot, and malicious apps delivered through third-party marketplaces. That means conventional post-deployment scanning is too late to prove trust. The issue is not only infection persistence, but the collapse of the assumption that sealed hardware equals clean hardware. In IoT environments, supply chain assurance has to cover manufacturer behaviour, marketplace integrity and the first boot sequence. See the IoT Security Guide.

Practical implication: Add pre-purchase risk checks and acceptance criteria so devices are not treated as trusted until they pass onboarding and integrity verification.

Threat narrative

Attacker objective: The attacker seeks durable control of large device populations that can be monetized for DDoS, intelligence collection, proxy services or downstream intrusion.

1. Entry begins with weak device identity, default credentials, exposed management surfaces or pre-infected supply chains that give attackers initial footholds into IoT fleets.
2. Escalation occurs when the attacker recruits additional devices, abuses centralized control planes or propagates through internal networks behind home routers and enterprise perimeters.
3. Impact follows as the compromised devices are used for record-scale DDoS, surveillance collection, proxy abuse, ransomware staging or exposure of telemetry and credentials.

Breaches seen in the wild

• Verkada camera breach 2021: Admin credentials on Verkada's exposed Jenkins support server let hackers into a support interface and customer cameras at 97 customers.
• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

IoT security is now an identity governance problem, not just a device hygiene problem. The article repeatedly shows that the decisive failure is not the presence of hardware, but the absence of managed identity and access around that hardware. Default credentials, unmanaged onboarding and unsegmented control paths turn connected devices into durable identities that attackers can borrow. That is why device governance must be treated as part of access governance, not as a separate operational issue.

Pre-infected hardware creates a trust gap that traditional post-deployment controls cannot close. BadBox 2.0 is important because it shows the failure of the assumption that a device can be trusted once it is unpacked and installed. The security model breaks earlier, at manufacturing, marketplace distribution or first boot. That means procurement, assurance and runtime containment have to work together, or the environment inherits the vendor's trust problem. Device and IoT Identity Guide is relevant here because device identity is the only durable control point available before and after onboarding.

Centralised IoT management becomes a privilege concentration risk when it is not treated as control plane infrastructure. The HPE OneView exploitation example shows that compromising one management layer can create outsized access across many assets. For practitioners, the lesson is that fleet managers, telemetry stores and orchestration systems need the same scrutiny as privileged admin systems. That includes access scoping, network isolation and change governance around device administration.

Botnet scale now reflects governance failure more than attacker sophistication. The article's repeated pattern is that known vulnerabilities, default passwords and slow patch cycles are enough to build infrastructure at industrial scale. That should shift the discussion away from novelty and toward containment, inventory and lifecycle discipline. If the environment still depends on devices that cannot be reliably discovered or segmented, the attacker's job remains easy.

What this signals

Device trust now has to be proven at onboarding. The practical shift is from assuming a new device is clean to requiring evidence that it was discovered, identified and placed into the right network zone before it can do any harm. In environments with large connected-device estates, this is becoming a baseline governance requirement rather than an advanced control.

IoT fleets are becoming the front line for identity governance in operational networks. When devices, management planes and cloud data stores all carry access risk, practitioners need one governance model for ownership, visibility and containment. The environments that win here will be the ones that treat device identity and network reachability as inseparable decisions.

For practitioners

• Enforce authenticated device onboarding Require every IoT, IoMT and OT device to pass through inventory, attestation and policy assignment before it can communicate with production networks.
• Segment connected devices by trust tier Place cameras, routers, DVRs and other constrained devices on paths that cannot reach identity stores, business applications or management systems.
• Harden default credential removal and device reset workflows Ban factory-default passwords, verify that resets do not restore vulnerable credentials, and record ownership for every device that is deployed.
• Treat management platforms as privileged infrastructure Apply tighter access review, logging and network isolation to telemetry stores and device orchestration systems than to ordinary application services.
• Add supply chain acceptance checks for new devices Reject devices that fail first-boot validation, vendor trust review or integrity checks, especially when they arrive through third-party marketplaces.

Key takeaways

• IoT compromise persists because weak device identity, default credentials and poor visibility make connected devices easy to recruit and hard to contain.
• The article ties record-scale botnets and exposed management systems to more than 3 million infected devices and 21.1 billion connected devices worldwide.
• Practitioners need authenticated onboarding, segmentation and supply chain verification before connected devices are allowed into production networks.

Related NHI Mgmt Group resources: Device and IoT Identity Guide · IoT Security Guide · OT Security Guide · Verkada camera breach 2021

Key terms

• IoT Botnet: An IoT Botnet is a group of internet-connected devices infected and controlled as a single malicious network. Attackers use it for distributed denial-of-service, scanning, proxying, and credential attacks. Defenders should remove default passwords, isolate devices, monitor outbound connections, and patch vulnerable firmware to prevent takeover and reuse.
• Device Identity: Device identity is the cryptographic proof that a specific machine is the thing being accessed, independent of its IP address or current network. In fleet governance, it allows policy, audit, and revocation to follow the device across locations and transports.
• Control Plane: The control plane is the set of actions that create, configure, or manage a service. For AI workloads, it covers deployment and administration of the model platform, while data-plane permissions govern what the service and its identities can read or process.
• Software Supply Chain Compromise: A software supply chain compromise is an attack that inserts malicious code into trusted build, package, or deployment paths. The goal is often not immediate application failure, but secret theft, persistence, or unauthorized changes that travel downstream through automated systems.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It gives practitioners a common framework for controlling non-human access across modern environments.