Topic starter
24/10/2026 8:53 pm
TL;DR: A January 2026 warning mapped campaign infrastructure against SSO accounts at more than 100 large organisations, Silent Push reported, months before Amgen disclosed stolen patient data and proprietary information. Recovery and vendor access need tighter governance because the first compromise can happen before a login is ever challenged.
Editorial analysis by NHI Mgmt Group, based on content published by Silent Push: “Amgen Breach: What Our January Warning Tells Defenders”.
By the numbers:
- Silent Push says it mapped adversary infrastructure against more than 100 large organizations in January 2026.
- Silent Push says the average lead time between spotting this kind of infrastructure and an attack landing is 154 days.
Key questions
A: Third-party providers expand the trust boundary and can become an indirect path into sensitive data and identity systems.
Q: How should security teams use pre-breach threat intelligence for identity defense?
A: They should translate named infrastructure into immediate identity action: watch the targeted accounts, tighten recovery controls, and limit session reach before the campaign lands.
Q: What breaks when a help desk can reset MFA after a phone call?
A: The assurance model breaks because the attacker no longer needs to defeat authentication technically.
Practitioner guidance
- Separate helpdesk reset events from same-call identity recovery Require a ticketed flow and a callback to a number already on file before any password reset, MFA reset, or device enrolment is approved.
- Add second approval for high-risk accounts Put administrators, security staff, and finance users behind a second approver and an out-of-band identity check before any credential state change.
- Watch named accounts once adversary infrastructure is identified When threat infrastructure points at a target set, place the named accounts under heightened review and harden their recovery paths before the campaign lands.
Bottom line: The breach path shows that identity support processes can be the weakest control point even when the technical authentication stack is sound.
Glossary terms: Indicator Of Future Attack, Session abuse, Recovery Workflow, Runtime Data Access
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:13 am
January infrastructure warnings are now an identity governance input, not just a threat intelligence artifact. The article shows that the useful decision point came months before the breach disclosure, when adversary infrastructure and target patterns were visible. That means IAM and security operations can no longer treat pre-compromise intelligence as separate from account governance. The practitioner conclusion is simple: if named accounts and infrastructure are already visible, identity controls must be able to move before the session is taken.
A few things that frame the scale:
- 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: Should organisations treat recovery access like privileged access?
A: Yes. Recovery systems can determine whether a ransomware event becomes a short disruption or a prolonged outage, so their administration should be governed like any other high-risk privilege path. That includes separation of duties, strong authentication, and tight control over who can restore or modify recovery infrastructure.
👉 Read our full editorial: Amgen breach shows how preemptive identity defense can shorten exposure
This post was modified 6 days ago by NHI Mgmt Group