Topic starter
24/06/2026 7:34 pm
TL;DR: Opal Security reviews ten major breaches from 2023 to 2025 and finds recurring identity governance failures, including stale credentials, missing MFA, over-privileged accounts, and weak third-party access, across incidents that affected more than 700 million people and cost organizations billions. The pattern is that governance gaps, not novel exploits, keep driving large-scale compromise.
Editorial analysis by NHI Mgmt Group, based on content published by Opal Security: “10 Recent Breaches that Could Have been Prevented with Modern IGA”.
Key questions
Q: What breaks when stale credentials and missing MFA are still allowed in production?
A: They create durable entry points that attackers can reuse long after the original leak or theft.
Q: Why do overprivileged accounts make breaches harder to contain?
A: Because the compromise of one account becomes the compromise of whatever that account can already reach.
Q: How do you know if an access review programme is actually working?
A: Look beyond completion rate.
Practitioner guidance
- Audit credential age and MFA coverage Identify service accounts, SaaS logins, and legacy portals where credentials are old, unrotated, or not covered by MFA.
- Reduce standing privilege on non-human identities Review service accounts, OAuth apps, and support tooling for permissions that exceed the minimum required for the current task or integration.
- Re-baseline third-party access after every relationship change Reconfirm vendor and contractor access whenever work changes, an engagement ends, or systems are acquired.
Bottom line: These breaches were not driven by a single new exploit pattern, but by repeated failures in identity governance and access control.
What's in the full article
Opal Security's full article covers the incident-by-incident access failures this analysis intentionally leaves at a higher level:
- Detailed breakdown of each of the ten breaches, including the specific identity control that failed in each case
- Per-incident impact figures, from customer counts to ransom payments and outage duration
- The vendor's mapped prevention logic for just-in-time access, access reviews, and third-party governance
- Examples of how legacy systems, service accounts, and outsourced support created recurring governance gaps
👉 Read Opal Security's analysis of the recent breaches modern IGA could have reduced →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:56 am
Modern IGA is now a breach containment control, not just an admin function. The incidents in this review show that access governance failures are doing the work of exploitation for attackers. When credentials are stale, MFA is missing, or accounts are never re-reviewed, adversaries do not need a novel exploit to reach sensitive systems. The practitioner conclusion is that IGA has become part of the breach prevention stack, not a back-office entitlement process.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: What should organisations do when third-party access outlives the business need?
A: Treat the access as a lifecycle problem, not a one-time approval. Revalidate vendor and contractor access whenever scope, ownership, or service relationships change, and remove support paths that no longer match the current engagement. That is how organisations prevent outsourced access from becoming a standing breach pathway.
👉 Read our full editorial: Modern IGA would have reduced the damage in recent breaches