One unrevoked key can expose millions through data access

At a glance

What this is: This is a data-breach analysis showing how one unrevoked authentication key and weak access controls enabled prolonged, undetected customer data access.

Why it matters: It matters to IAM, PAM, NHI, and data security teams because lifecycle failure in a single credential can turn into a large-scale governance and notification problem.

By the numbers:

• Securiti says the incident affected 37.5 million people, including 33.22 million users and roughly 4.33 million third-party data subjects.
• The regulator fined Coupang 624.68 billion won, approximately $409 million, in the largest data-breach penalty ever imposed by a Korean regulator.

👉 Read Securiti's analysis of the Coupang breach and data access failure

Context

A revoked identity is only safe if every dependent token, signing key, and application path is actually invalidated. In this case, the core governance gap was not exotic exploitation but the persistence of trusted access after the employee relationship had ended, combined with weak visibility into what that access could reach.

For identity and data teams, this is a classic example of lifecycle control failure meeting blast-radius failure. The same credential problem that starts in IAM or secrets management becomes a data governance issue once teams cannot quickly answer which sensitive records were reachable, how long the access persisted, and whether the activity looked normal.

The starting position here is unfortunately typical of modern breach patterns: a valid credential looks legitimate at the authentication layer while remaining dangerous at the data layer.

Key questions

Q: What breaks when a departed employee’s signing key is still valid?

A: A departed identity can still mint or use trusted access, which means the system may treat the session as legitimate even though the human relationship is gone. The failure is not just authentication. It is offboarding that does not fully revoke dependent credentials, tokens, and application trust paths, leaving a standing exposure window.

Q: Why do stale accounts make credential compromise worse?

A: Stale accounts extend the time an attacker can use a valid password without raising suspicion. They often bypass the normal attention given to active users, yet still retain authentication paths and sometimes privileged entitlements. That makes them an efficient entry point when exposed credentials are circulating in breach data.

Q: How can security teams tell whether credential governance is mature enough?

A: Look for measurable controls, not claims of modernisation. Mature governance can show where credentials are issued, who owns them, how they are revoked, and whether those actions are visible to audit and compliance stakeholders. If the programme cannot produce that evidence, it is not yet operating as a governed identity system.

Q: Who is accountable when access persists after termination and a breach follows?

A: Accountability should be shared across IAM, data security, privacy, and legal operations, because the control failure spans credential lifecycle, data exposure, notification, and evidence handling. Frameworks such as NIST CSF and NIST SP 800-53 expect clear ownership for access control and incident response, not informal handoffs.

Technical breakdown

How a retained signing key can preserve trusted access

A signing key is the cryptographic secret used to create tokens that downstream systems trust. If that key remains valid after an employee leaves, the attacker does not need to break authentication in the usual sense. They can produce or replay access that appears legitimate unless revocation, audience checks, scope validation, and downstream authorisation are strict enough to stop it. This is why token trust and human employment lifecycle must be bound together.

Practical implication: revoke signing keys, dependent secrets, and issued tokens together when an identity leaves or changes role.

Why valid access can stay hidden in normal logs

Normal-looking credentials often generate normal-looking telemetry. If logging is fragmented across IAM, application, database, and data-classification layers, a long-lived access path can blend into routine production activity. Detection depends on correlating identity state, credential age, source geography, request volume, and the sensitivity of the target data. Without that correlation, a valid credential can be both authorised and abusive at the same time.

Practical implication: correlate identity, activity, and data sensitivity telemetry so stale access becomes measurable instead of invisible.

Why data access intelligence changes the control picture

Data access intelligence links who or what can reach a dataset to the dataset’s sensitivity and actual usage patterns. That matters because access review alone answers entitlement questions, not blast-radius questions. In this incident, the key issue was not only whether access existed, but what customer records could be reached and whether the pattern of access should have triggered concern earlier. The control gap is a blind spot between access governance and data governance.

Practical implication: rank remediation by dataset sensitivity and reachable blast radius, not by entitlement lists alone.

Threat narrative

Attacker objective: The objective was prolonged access to customer data through a trusted credential path that did not look malicious at the authentication layer.

1. Entry occurred through a still-valid authentication signing key retained after employee departure, allowing trusted access to continue without a fresh intrusion event.
2. Escalation came from the fact that the credential could reach sensitive customer data through ordinary application paths that were not tightly constrained or monitored.
3. Impact was prolonged unauthorised access to customer and third-party data over months, followed by a major regulatory penalty and breach-notification obligations.

Breaches seen in the wild

• Salesloft OAuth token breach — hackers stole OAuth tokens to access Salesforce data via Salesloft.
• Vercel Context.ai OAuth Supply Chain Breach — Shadow AI app Context.ai OAuth integration exposes Vercel customer data via unmanaged third-party token.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Credential lifecycle is a data security control, not just an IAM hygiene task. This breach shows that revocation timing matters only when it is tied to the systems a credential can reach. A valid key with broad data reach is a standing exposure window, not merely a stale account. For identity teams, lifecycle failure must be treated as an active data-risk condition, not an administrative cleanup issue.

Data access intelligence is the missing control plane between entitlement and evidence. IAM can tell you whether access exists, but it cannot on its own explain whether the access is proportionate to the data at risk. That is the governance gap this case exposes: organisations need a correlated view of identity, object, and dataset sensitivity so abnormal access can be triaged quickly. Practitioner conclusion: access review without data context is incomplete governance.

The breached assumption was that a departed identity can be made harmless by leaving the credential technically valid. The incident worked because the organisation appears to have lacked a firm revocation boundary that cut off every dependent token and access path. This is the failure mode behind many NHI and service-account incidents as well. Practitioner conclusion: if a credential can still authenticate, the identity is not really offboarded.

Regulatory accountability now reaches the entire lifecycle of trusted access, not just the point of intrusion. The PIPC findings extended beyond access control into notification, evidence preservation, and data destruction. That means security, privacy, and legal teams must treat breach readiness as a joint operational discipline. Practitioner conclusion: if your controls cannot support post-incident proof, they are incomplete before the incident even starts.

From our research:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials, according to AI Agents: The New Attack Surface report.
• Only 33% of organisations report that their AI agents have accessed inappropriate or sensitive data beyond intended scope, which still leaves a substantial governance blind spot for identity and data teams.
• See also 52 NHI Breaches Analysis for breach patterns where stale trust, credential abuse, and weak lifecycle control created similar exposure paths.

What this signals

Standing trust is becoming a measurable risk variable. The lesson for identity programmes is that revocation speed now has direct data-governance consequences, especially when service accounts, signing keys, or application tokens can reach regulated records. Teams should treat the age of a credential and the sensitivity of its reachable data as a single prioritisation signal, not separate chores.

Blast-radius control is the real test of mature access governance. The practical question is no longer whether a credential exists, but whether the organisation can prove what it could touch and whether that access still made sense at the time. That is where NHI governance, PAM, and data security need shared telemetry, not disconnected reports.

For teams managing AI agents or other non-human identities, this breach reinforces the need to tie lifecycle controls to reachable data and post-incident evidence. Correlated identity, access, and data context is what turns a breach investigation from reconstruction into defensible proof.

For practitioners

• Map every credential to reachable data sets Build an entitlement-to-data map for human, service, and signing credentials so teams can see which sensitive records each identity can actually reach. Prioritise credentials that touch regulated or high-volume customer data first.
• Revoke dependent access at offboarding time When a person leaves or changes role, revoke signing keys, refresh tokens, API keys, and any downstream application trust that depends on that identity. Treat offboarding as a multi-system control event, not a single directory update.
• Correlate access age with data sensitivity Use access telemetry and classification context to flag long-lived credentials that continue reading sensitive datasets after role change, departure, or inactivity. Sustained access to high-value records should trigger review before it becomes a breach window.
• Preserve evidence before remediation starts Establish a breach workflow that freezes relevant logs, access records, and data snapshots before cleanup or destructive changes begin. Post-incident defensibility depends on being able to reconstruct who touched what and when.

Key takeaways

• This breach shows that a single unrevoked credential can become a prolonged data exposure window when offboarding and revocation are not tightly bound together.
• The scale was severe, with 37.5 million people affected and a $409 million penalty, which shows how access control failures quickly become regulatory failures.
• Teams need correlated identity, access, and data visibility so they can reduce blast radius before a valid credential turns into a breach.

Key terms

• Signing Key: A signing key is a secret used to create or verify trusted authentication material. When that key is tied to identity infrastructure, it can become a high-value trust anchor that affects many systems at once. If it is reused or left unrotated, compromise can spread far beyond the original service.
• Data Access Intelligence: Data access intelligence is the practice of connecting identity, entitlement, activity, and data sensitivity so teams can see what a credential can actually reach. It turns access review into blast-radius analysis and helps security and privacy teams prioritise the records and systems that matter most.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Credential Lifecycle: Credential lifecycle is the process of issuing, rotating, expiring, and revoking secrets, certificates, and tokens across their usable life. For non-human identities, lifecycle discipline is the core control that separates temporary access from persistent exposure.

What's in the full article

Securiti's full article covers the operational detail this post intentionally leaves for the source:

• A phase-by-phase breakdown of the Coupang access failure, including the regulator's findings and the access-control gaps.
• The data access intelligence model used to connect entitlement, activity, and dataset sensitivity across the estate.
• Step-by-step remediation priorities for offboarding, key rotation, and evidence preservation in breach response.
• The table of incident-phase questions that helps teams test whether they can prove who or what touched sensitive data.

👉 The full Securiti article covers the regulator findings, control gaps, and data access intelligence response model.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management, and identity lifecycle control. It gives security and identity practitioners a practical foundation for governing trusted access across human and non-human identities.