Topic starter
02/08/2026 12:29 pm
TL;DR: 184 million plaintext credentials showed how infostealer malware and weak storage can widen credential blast radius, with Unixi's data set spanning Google, Apple, Microsoft and other services in more than 29 countries. Identity governance now has to cover browser artefacts, tokens and unmanaged apps, not just password policy.
Editorial analysis by NHI Mgmt Group, based on content published by Unixi: “184 Million Reasons to Eliminate Passwords for Good”.
By the numbers:
- In May 2025, a massive Google and Apple data breach exposed over 184 million login credentials.
- The compromised accounts included data from over 29 countries.
Key questions
Q: Why do browser cookies and session tokens increase account takeover risk?
A: They can preserve authenticated access even after a password changes, which means the stolen session may remain usable until it expires or is explicitly revoked.
Q: How should security teams govern shadow IT in SaaS environments?
A: Security teams should govern shadow IT by treating it as unmanaged access, not just unsanctioned software.
Q: What breaks when malware steals passwords and browser data at scale?
A: What breaks is the assumption that a credential is only dangerous while the infected device is still active.
Practitioner guidance
- Inventory browser-stored credentials Map which endpoints, browsers and managed devices store usernames, passwords, cookies and tokens, then identify where those secrets can be copied or synced outside policy.
- Reduce standing value in session artefacts Shorten session lifetimes, revoke bearer tokens aggressively after suspicious activity, and ensure refresh paths do not preserve access longer than the risk window allows.
- Bring shadow SaaS into identity governance Classify browser-based apps that sit outside SAML or SCIM coverage, assign ownership for each one and define how access is discovered and revoked.
Bottom line: This breach shows that password controls alone cannot contain identity compromise when browser storage, tokens and shadow SaaS are part of the attack surface.
Glossary terms: Infostealer Malware, Shadow SaaS, Session artefacts, Credential Blast Radius
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 1:27 pm
Plaintext credential exposure is not a password problem, it is an identity lifecycle failure: The breach worked because credentials were harvested, stored and redistributed outside any governed lifecycle boundary. Password-centric programmes assume the secret remains under policy until authentication time, but browser storage and unprotected servers break that assumption. The practitioner conclusion is clear: control has to follow the credential after issuance, not just at login.
A few things that frame the scale:
- The average user manages 70 to 100 passwords, many of them outside centralised identity platforms.
A question worth separating out:
Q: What should organisations do when password-based IAM no longer covers the full SaaS stack?
A: Organisations should reduce dependence on locally stored secrets, tighten endpoint protection and extend identity governance to the long tail of browser apps. Where federation is unavailable, they need compensating controls that limit credential reuse and make revocation immediate and visible.
👉 Read our full editorial: Google and Apple credential leak exposes the limits of password security