Topic starter
12/06/2026 10:06 pm
TL;DR: Three 2022 breaches show how exposed credentials, post-employment access, and phishing can still bypass enterprise controls, according to Axiad. The common failure is not just user error but weak identity governance over third parties, leavers, and authentication paths.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “2022 Data Breaches: What Happened and What Did We Learn?”.
Key questions
Q: What breaks when third-party credentials are published in source code?
A: A public code leak becomes an access event when secrets remain valid after exposure.
Q: Why do ex-employee accounts still create breach risk after offboarding?
A: Because offboarding is only effective when entitlements, report access, and authentication paths are removed together.
Q: How can organisations tell whether authentication is actually phishing-resistant?
A: Authentication is phishing-resistant when a stolen code, password, or proxy cannot be reused to satisfy the login flow.
Practitioner guidance
- Review third-party credential exposure paths Inventory where contractors and subcontractors can place source code, keys, and tokens, then revoke any access that is not explicitly needed for the current engagement.
- Tighten offboarding for report access Map every privileged report, export path, and customer data view to a leaver revocation step so terminated users lose access before account closure is complete.
- Enforce phishing-resistant sign-in Require hardware-key or equivalent phishing-resistant authentication for the accounts that would cause material harm if credentials were captured.
Bottom line: These 2022 breaches show that identity failures can originate in third-party credential handling, offboarding gaps, and phishing, even when organisations already have security controls in place.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
13/06/2026 12:38 am
Third-party credential exposure is a lifecycle failure, not a one-off mistake: The Toyota case shows that a subcontractor’s public GitHub upload became a live enterprise risk because the credential stayed usable long after exposure. That is not just secret leakage. It is a breakdown in ownership, inventory, and revocation discipline across the extended identity supply chain. Practitioners should read this as a warning that third-party access is only as safe as its offboarding and rotation controls.
A question worth separating out:
Q: Should identity teams prioritise offboarding or phishing resistance first?
A: If the organisation has repeated leaver-access or third-party access problems, offboarding and entitlement control usually need immediate attention. If the dominant risk is credential theft through social engineering, phishing-resistant authentication should move up the list. The right priority depends on which identity path is most likely to fail first.
👉 Read our full editorial: 2022 breach patterns show why identity controls still fail