Topic starter
11/07/2026 1:55 pm
TL;DR: 2025 data breaches were shaped by healthcare losses, Salesforce-related customer exposures, and massive credential dumps built from infostealer logs and ULP lists, while AI mostly amplified phishing and credential stuffing rather than replacing old attack patterns, according to Enzoic. The operational lesson is blunt: identity hygiene, credential monitoring, and MFA still determine whether broad exposure becomes account takeover or stays contained.
Editorial analysis by NHI Mgmt Group, based on content published by Enzoic: “Inside the Credential Economy”.
Key questions
Q: What fails when exposed credentials are not monitored across the identity estate?
A: The failure is visibility, not just policy.
Q: Why do third-party systems increase breach spread?
A: Third-party systems increase breach spread because organisations often trust the business relationship more than the control environment behind it.
Q: Should organisations rely on MFA alone after a credential dump?
A: No. MFA can reduce the value of stolen passwords, but it does not erase the underlying exposure when secrets are dumped from storage or memory. Organisations need layered controls that limit reuse, reduce privilege, and restrict where credentials are stored and loaded. MFA is containment, not a substitute for secret lifecycle governance.
Practitioner guidance
- Monitor exposed credentials continuously Use credential monitoring to detect when usernames and passwords appear in infostealer logs, ULP lists, or other compromise feeds, then prioritise accounts tied to external login endpoints and high-value applications.
- Reduce password reuse across user populations Enforce unique credentials, remove shared passwords where possible, and focus on accounts that can be reused across SaaS, VPN, and administrative interfaces.
- Expand MFA coverage to exposed access paths Apply MFA not only to employees but also to external access paths and high-risk applications that would otherwise accept stolen credentials as valid authentication.
Bottom line: Credential breaches in 2025 kept following the same pattern: stolen access, reused access, and broad downstream compromise.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 2:06 pm
Credential reuse is now the durable breach substrate: The 2025 pattern is not about one spectacular exploit, but about recycled access persisting across sectors and services. Once login data is harvested, the same identity material can be replayed into account takeover, fraud, or secondary intrusion with minimal extra effort. That makes identity hygiene the first-order control plane, not an administrative afterthought.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- Credential abuse across the entire attack chain, not just initial access, appears in 39% of all breaches, according to the 2026 Verizon Data Breach Investigations Report.
A question worth separating out:
Q: What should IAM teams do after credential stuffing succeeds on a login?
A: Treat a successful stuffed login as a verified account compromise, not as an isolated authentication event. Revoke active sessions, review connected services, check for password resets or privilege changes, and look for fraud or lateral access from the same source pattern. The key is to investigate the cluster, not only the account.
👉 Read our full editorial: 2025 credential breaches show why basics still fail at scale