Notifications
Clear all
Topic starter
06/09/2026 6:20 pm
TL;DR: The first week of October 2025 brought ten major incidents affecting more than 5.5 million people and organisations, with attackers leaning on credential stuffing, social engineering, ransomware, and third-party compromise across aviation, insurance, automotive, gaming, telecoms, and software, according to FireCompass. The pattern is clear: identity assurance, vendor access, and cloud-hybrid monitoring remain the weakest links when attacks move from entry to exfiltration.
NHIMG editorial — based on content published by FireCompass: Weekly Cybersecurity Intelligence Report Cyber Threats and Breaches 30 Sep to 07 Oct, 2025
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes.
Questions worth separating out
Q: What breaks when valid accounts are used to move from access to exfiltration?
A: The main failure is that authentication no longer proves legitimacy after the session starts.
Q: Why does third-party access so often become a breach path in regulated environments?
A: Third-party access becomes risky when organisations trust external identities more than they should and fail to narrow permissions to the smallest practical scope.
Q: How can security teams tell whether valid-account abuse is actually being contained?
A: Look for a short gap between successful authentication and containment, limited lateral movement, and no bulk transfer after anomalous login or API activity.
Practitioner guidance
- Map the highest-risk trust paths first Identify the accounts, resets, APIs, and vendor links that can reach sensitive data or cloud administration in one hop.
- Review third-party entitlements for offboarding gaps Check whether vendor access is still active after contracts, projects, or integrations change.
- Correlate identity events with exfiltration signals Tie successful authentication, unusual API activity, and bulk transfer events into one detection path so valid accounts are not treated as harmless simply because they authenticated correctly.
What's in the full article
FireCompass's full weekly intelligence report covers the operational detail this post intentionally leaves for the source:
- Incident-by-incident timelines for each breach, including the order of access, persistence, exfiltration, and disclosure.
- Technical indicators such as MITRE ATT&CK mappings, IOCs, and log artefacts for detecting similar campaigns.
- Remediation notes and response actions specific to each organisation and attack path.
- The full list of incidents beyond the major cases summarised here, including sector and impact details.
👉 Read FireCompass's weekly cybersecurity intelligence report on the early October 2025 breach wave →
Credential abuse and supply chain compromise: what teams should act on?
Explore further
06/09/2026 6:21 pm
Identity trust breaks fastest where human credentials, delegated vendor access, and cloud workflows intersect. This report shows that attackers do not need to defeat every layer of security when one trusted identity path can unlock data, administration, and persistence. IAM teams, NHI owners, and PAM leads should treat shared trust paths as the primary governance boundary, not as separate operational silos.
A few things that frame the scale:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
A question worth separating out:
Q: What is the difference between credential stuffing and credential misuse in a breach response?
A: Credential stuffing is the entry method, where stolen username and password pairs are tested at scale. Credential misuse is what happens after compromise, when the attacker uses that access to reach data, APIs, or administrative tools. The response focus changes from login hardening to session containment and entitlement review.
👉 Read our full editorial: Weekly cybersecurity intelligence shows credential abuse drove 5.5M impacts
