Topic starter
02/08/2026 12:29 pm
TL;DR: A May 2025 breach exposed over 184 million plaintext login credentials across Google, Apple, Microsoft and other services after infostealer malware fed data into an unsecured ElasticSearch server, according to Unixi, including banking, government and healthcare accounts in more than 29 countries. Password-based IAM is no longer a complete control when browsers, tokens, cookies and shadow SaaS expand the attack surface beyond the identity provider.
Editorial analysis by NHI Mgmt Group, based on content published by Unixi: “184 Million Reasons to Eliminate Passwords for Good”.
By the numbers:
- In May 2025, a massive Google and Apple data breach exposed over 184 million login credentials.
- The compromised accounts included data from over 29 countries.
Key questions
Q: What breaks when malware steals passwords and browser data at scale?
A: What breaks is the assumption that a credential is only dangerous while the infected device is still active.
Q: Why do browser cookies and session tokens increase account takeover risk?
A: They can preserve authenticated access even after a password changes, which means the stolen session may remain usable until it expires or is explicitly revoked.
Q: How should security teams govern shadow IT in SaaS environments?
A: Security teams should govern shadow IT by treating it as unmanaged access, not just unsanctioned software.
Practitioner guidance
- Inventory browser-stored credentials Map which endpoints, browsers and managed devices store usernames, passwords, cookies and tokens, then identify where those secrets can be copied or synced outside policy.
- Reduce standing value in session artefacts Shorten session lifetimes, revoke bearer tokens aggressively after suspicious activity, and ensure refresh paths do not preserve access longer than the risk window allows.
- Bring shadow SaaS into identity governance Classify browser-based apps that sit outside SAML or SCIM coverage, assign ownership for each one and define how access is discovered and revoked.
Bottom line: This breach shows that password controls alone cannot contain identity compromise when browser storage, tokens and shadow SaaS are part of the attack surface.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:27 pm
Plaintext credential exposure is not a password problem, it is an identity lifecycle failure: The breach worked because credentials were harvested, stored and redistributed outside any governed lifecycle boundary. Password-centric programmes assume the secret remains under policy until authentication time, but browser storage and unprotected servers break that assumption. The practitioner conclusion is clear: control has to follow the credential after issuance, not just at login.
A few things that frame the scale:
- The average user manages 70 to 100 passwords, many of them outside centralised identity platforms.
A question worth separating out:
Q: What should organisations do when password-based IAM no longer covers the full SaaS stack?
A: Organisations should reduce dependence on locally stored secrets, tighten endpoint protection and extend identity governance to the long tail of browser apps. Where federation is unavailable, they need compensating controls that limit credential reuse and make revocation immediate and visible.
👉 Read our full editorial: Google and Apple credential leak exposes the limits of password security