Credential theft in cloud platforms: what should MSPs fix first?

TL;DR: Dozens of global enterprises across aviation, defense, healthcare, legal services and critical infrastructure were breached through credential theft that started with infected devices, stolen passwords and session tokens, then moved straight into cloud platforms, according to Todyl. The pattern shows that MFA gaps and weak device hygiene can turn ordinary collaboration tools into high-value breach paths, and identity controls now need to be judged by exposure, not just login success.

Editorial analysis by NHI Mgmt Group, based on content published by Todyl: “How Credential Theft Attacks Are Costing MSP Clients Millions”.

Key questions

Q: What breaks when stolen credentials are enough to access cloud platforms?

A: The control that breaks is the assumption that successful authentication equals legitimate access.

Q: Why do stolen session tokens create so much more risk than ordinary file theft?

A: Stolen session tokens are risky because they can bypass password checks and act like already authenticated access.

Q: What should MSPs prioritise first after discovering credential theft exposure?

A: Prioritise containment of active sessions, enforcement of MFA everywhere and review of the cloud repositories that hold the most sensitive client data.

Practitioner guidance

• Enforce MFA across every cloud access path Remove exceptions for legacy apps, shared collaboration tools and administrative portals so a stolen password cannot become a valid session.
• Shorten the useful life of stolen sessions Revoke sessions on suspicious device events, require reauthentication after risk spikes and treat token theft as a containment trigger.
• Inventory where the most sensitive data lives Identify cloud platforms holding customer records, strategy documents, legal files and engineering assets, then apply stricter access scoping to those repositories.

Bottom line: Credential theft campaigns succeed when stolen passwords and session tokens are still accepted as legitimate access.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →