Password hygiene failures keep turning breaches into privilege loss

At a glance

What this is: This analysis ties several high-profile breaches to password hygiene failures, showing how weak credentials, reused access, and poor privilege discipline can cascade into broader compromise.

Why it matters: It matters because IAM, PAM, and NHI teams still lose control when basic credential hygiene breaks down, and those failures often create the first foothold for lateral movement and data exposure.

Context

Password hygiene is the discipline of preventing reusable credentials, weak vault access, and unmanaged privileged accounts from becoming the easiest path into critical systems. In this article, the security problem is not a lack of advanced tooling, but the persistence of basic access weaknesses that let attackers move from initial compromise to privileged access.

The article uses recent incidents to show that identity failures do not stay isolated at the endpoint or inbox. Once privileged credentials, shared vault access, or orphaned accounts exist, the blast radius expands quickly across cloud consoles, collaboration tools, and internal systems.

Key questions

Q: What breaks when hardcoded credentials are left in code or configuration files?

A: Hardcoded credentials break the assumption that access can be rotated, revoked, and audited on demand. Once a secret is embedded in code or config, it is easy to copy, hard to trace, and often reused across environments. That turns a single secret into a durable access path that is difficult to contain after exposure.

Q: Why do stolen password vaults create so much enterprise risk even when the vault contents are encrypted?

A: Encrypted vaults can still be dangerous because the surrounding metadata often reveals which users belong to which SaaS apps, along with duplicate passwords. That combination gives attackers a ready-made map for account takeover across the SaaS layer. The result is not one broken account but repeated access attempts across many services that security teams may not even know exist.

Q: How can security teams tell whether privilege creep is still creating exposure?

A: Look for accounts with no clear owner, credentials that are older than the systems they protect, and access rights that no longer match job or service requirements. Those signals show that privilege is persisting beyond its intended lifecycle, which is exactly what attackers look for after initial compromise.

Q: What should organisations do when repeated MFA prompts appear on an account?

A: Treat the event as potential compromise, not normal friction. Suspend the prompt loop, verify the user through a stronger channel, review recent password activity, and check for lateral movement from the account. Fast containment matters because the approved session may already be active.

Technical breakdown

How phishing and MFA fatigue become privileged access

The Uber case shows a common access chain: social engineering creates an initial authentication event, the victim approves repeated MFA prompts, and the attacker inherits a valid session. That kind of access is not exploit-driven in the classic sense. It is identity-driven, because the control failure sits in the approval process and the trust placed in a single human confirmation. Once the session is established, internal tools and shared resources become reachable without any additional perimeter break. Practical implication: treat MFA approval abuse as an access-path problem, not just a login-event problem.

Practical implication: Instrument approval fatigue, step-up prompts, and unusual MFA frequency as privilege-risk signals, not just authentication telemetry.

Why hardcoded credentials turn scripts into privilege escalators

The article’s Uber example also shows how a single script with embedded administrator credentials can collapse privilege boundaries. Hardcoded credentials are dangerous because they persist outside normal credential lifecycle controls, are easy to reuse, and often escape the governance applied to managed secrets. Once discovered, they can unlock tokens, cloud consoles, and collaboration systems in sequence. That is a classic non-human identity problem: a secret behaves like a standing account even when it is hidden in code. Practical implication: every script, image, and repository must be treated as a credential-bearing surface.

Practical implication: Search code, build artifacts, and shared files for embedded secrets before assuming privileged access is properly governed.

How weak vault protection defeats password management

The Intercontinental Hotel Group incident illustrates that a password vault is only as strong as the controls protecting its access path. If the vault password is weak, broadly shared, or reused, the vault becomes a high-value concentration point instead of a control boundary. The article also highlights orphaned and overexposed access, where too many employees can reach sensitive credentials. That defeats the purpose of centralized credential control because the vault itself becomes the easiest account to attack. Practical implication: governance must cover vault access, vault passwords, and the credentials stored inside the vault as one lifecycle.

Practical implication: Review who can open the vault, how the vault is authenticated, and whether the stored secrets are more exposed than the systems they protect.

Threat narrative

Attacker objective: The attacker seeks privileged access that can be reused across systems to steal data, disrupt operations, and widen the breach beyond the original entry point.

1. Entry began with phishing or MFA fatigue that gave the attacker a valid foothold through a user account or approval flow.
2. Credential access followed when the attacker found hardcoded administrator secrets or weak vault credentials that exposed privileged systems.
3. Escalation occurred as those credentials unlocked internal tools, cloud consoles, collaboration platforms, and additional sensitive data.
4. Impact was enterprise-wide compromise, including data theft, operational disruption, and in one case destructive wiper activity.

Breaches seen in the wild

• Uber breach 2016: An AWS key posted to Uber's private GitHub repositories let intruders copy data on 57 million people; Uber paid $100,000 and hid it for a year.
• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Password hygiene is now privilege governance, not just user discipline: The article shows that weak credentials, reused vault access, and exposed administrator secrets can collapse the boundary between initial access and privileged access. That makes password hygiene part of enterprise privilege governance, not a narrow authentication task. The control question is no longer whether passwords are inconvenient, but whether access remains governable once the first secret is lost.

Hardcoded credentials create standing privilege in disguise: A secret embedded in a script behaves like a long-lived service credential even when teams believe it is buried and harmless. That breaks the assumption that privilege only exists where identity teams can inventory it. The implication is that code, scripts, and shared artefacts now sit inside the credential lifecycle whether organisations admit it or not.

Weak vault access turns centralisation into concentration risk: Central password repositories reduce sprawl only when access to the vault is more controlled than the systems it protects. If everyone can open the vault or the vault password is weak, centralisation amplifies the blast radius instead of shrinking it. Practitioners should treat vault governance as an identity control surface in its own right.

Privilege creep and orphaned access remain breach accelerants: The article’s emphasis on visibility into accounts and access rights reflects a deeper governance gap. When dormant accounts, shared credentials, and unmanaged privileges persist, attackers do not need advanced exploit chains to expand impact. The practical conclusion is that access review quality matters as much as password complexity.

Identity security still fails at the basics before it fails at the edge: These incidents do not prove that advanced controls are useless. They prove that weak first-line controls can nullify advanced tooling by handing attackers a valid identity path. Teams should therefore judge maturity by how well they contain credential abuse, not by how many tools they deploy.

From our research library:

• 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
• Read next: Password Security and Password Manager Guide

What this signals

Credential hygiene is a governance control, not a user preference: Once a script, vault, or employee account carries a reusable secret, the organisation has created a second identity path that sits outside intended control boundaries. That is why password policy, vault governance, and privileged access review need to be treated as one operational discipline, not separate tasks.

Access reviews fail when ownership is unclear: Orphaned accounts and shared credentials survive because no one can confidently say who should remove them. In that environment, the review process becomes a reporting exercise instead of a control, and attackers benefit from the gap between nominal ownership and real access.

Improve visibility into credential-bearing assets before breach data appears: The practical priority is to know where privileged secrets live, who can retrieve them, and which systems still trust them. Without that map, every other control becomes reactive rather than preventative.

For practitioners

• Hunt for hardcoded credentials in code and scripts Scan repositories, shared drives, and operational scripts for embedded administrator secrets, then replace them with managed secret references and revoke any exposed values.
• Tighten vault access and vault authentication Require strong authentication to open the password vault, reduce who can reach it, and verify that vault accounts are not broadly shared across the organisation.
• Review dormant and orphaned accounts Build an inventory of accounts that no longer have a clear owner or active business purpose, then remove or re-authorise them before attackers can use them as silent footholds.
• Monitor MFA approval abuse patterns Track repeated push requests, abnormal approval timing, and access from unfamiliar devices so that social-engineering-driven login abuse is visible before privilege expands.
• Send password and access activity into SIEM Forward vault logins, credential retrieval events, and privileged access changes into the SIEM so analysts can correlate credential misuse with downstream system access.

Key takeaways

• The article shows that many breaches still begin with basic credential abuse, not exotic exploitation.
• Weak vault access, embedded secrets, and unmanaged privileges all widen the blast radius once an attacker gets a foothold.
• The most effective limiters are better secret lifecycle control, stronger vault governance, and sharper visibility into who can still use privileged access.

Key terms

• Password Hygiene: Password hygiene is the practice of creating, storing and using passwords in ways that reduce compromise risk. It includes length, uniqueness, blocklisting common secrets and avoiding reuse across systems. In mature programmes, it is treated as a governance issue, not only a user-behaviour issue.
• Privileged Access: Privileged access is any elevated entitlement that can change systems, data, or security settings. When privilege is excessive or poorly scoped, a single compromised identity can create outsized blast radius across environments.
• Hardcoded Credential: A secret such as a password, API key, or token embedded directly in source code rather than retrieved from a secure vault at runtime. Hardcoded credentials are one of the most common and dangerous NHI vulnerabilities.
• Password Vault: A password vault is a central store for user credentials protected by a master secret or device. It reduces user friction, but it also concentrates risk because compromise of the vault can expose many downstream accounts and create a broad identity blast radius.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.