Notifications
Clear all
Topic starter
02/08/2026 12:29 pm
TL;DR: A May 2025 breach exposed more than 184 million plaintext credentials across Google, Apple, Microsoft and other services, with banking, government and healthcare logins included, after infostealer malware fed data into an unsecured ElasticSearch server. Traditional password-based IAM fails when session cookies, tokens and unmanaged SaaS expand the attack surface far beyond the identity provider.
NHIMG editorial — based on content published by Unixi covering the Google and Apple credential leak
Questions worth separating out
A: Teams should assume the password is already lost and focus on revoking sessions, invalidating tokens, and re-establishing trust at the device and identity layer.
Q: Why do unmanaged SaaS apps create access risk even when SSO is in place?
A: Because SSO only governs the apps it covers.
Q: What breaks when session tokens are stored insecurely?
A: If tokens are readable by browser scripts or are not rotated and revoked correctly, a single XSS issue or stolen token can preserve attacker access after login.
Practitioner guidance
- Inventory unmanaged browser-based applications Map every SaaS application that accepts local login, stored credentials or non-federated access, then classify whether it sits outside SSO, SCIM and MFA policy enforcement.
- Treat session cookies as credentials Extend incident response to include token and cookie invalidation when infostealer exposure is suspected.
- Combine endpoint and identity telemetry Correlate infostealer detections, suspicious login geography and impossible session reuse so the identity team can identify which accounts may already be compromised before normal sign-in failures appear.
What's in the full article
Unixi's full article covers the operational detail this post intentionally leaves for the source:
- The full breach narrative and the exact credential mix found in the exposed dataset.
- The vendor's breakdown of why shadow SaaS bypasses standard identity provider controls.
- Practical recommendations for passwordless rollout, endpoint hardening and phishing-resistant MFA.
- The article's explanation of how Universal SSO is positioned against unmanaged browser-based access.
👉 Read Unixi's analysis of the Google and Apple credential leak →
Google and Apple credential leak: are password controls still enough?
Explore further
02/08/2026 1:27 pm
Password exposure is now an identity reuse problem, not a password policy problem. When plaintext credentials, cookies and metadata are exposed together, attackers are no longer solving authentication, they are replaying identity. That collapses the assumption that password complexity or rotation alone meaningfully reduces risk. The practitioner conclusion is that identity assurance must account for the artefacts that survive login, not just the password itself.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
- A separate finding in the same report shows that enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months.
A question worth separating out:
Q: What should organisations do first when infostealer activity is suspected on user endpoints?
A: Contain the endpoint, invalidate active sessions, rotate affected credentials and review which unmanaged apps may still trust the stolen artefacts. The priority is to break replayability before the attacker can use harvested identity material across multiple services. Containment must happen across both device and identity planes.
👉 Read our full editorial: Google and Apple credential leak exposes the limits of password security
