Notifications
Clear all
Topic starter
12/06/2026 12:07 am
TL;DR: Leaked credentials remain a leading breach driver, with IBM’s 2025 Cost of a Data Breach Report putting the average loss from compromised-credential incidents at $4.67 million and Orca Security noting attackers can exploit exposed secrets in minutes. The governance gap is not detection alone but whether IAM, CIEM, and JIT controls shrink the blast radius fast enough.
NHIMG editorial — based on content published by Orca Security: leaked passwords and how they expose cloud environments
By the numbers:
- breaches caused by compromised credentials result in average losses of $4.67 million USD per incident
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes
Questions worth separating out
Q: How should security teams respond when a cloud password is found in a breach dump?
A: Treat it as a live identity exposure, not a static secret issue.
Q: Why do leaked passwords create so much more risk in cloud environments?
A: Cloud services are directly reachable and often tied to management permissions, data stores, and automation.
Q: What do organisations get wrong about leaked credentials?
A: They often treat discovery as the finish line.
Practitioner guidance
- Treat leaked passwords as active identity incidents When a password is confirmed in a public breach corpus or dark web source, open it as an access event, not a scanning finding.
- Map privileged exposure before reset workflows begin Identify whether the leaked account can reach cloud management planes, automation jobs, or sensitive data stores.
- Use JIT to shrink the value of stolen credentials Where permanent elevation is not required, replace always-on access with time-bound access that expires after the task finishes.
What's in the full article
Orca Security's full research covers the operational detail this post intentionally leaves for the source:
- The specific detection logic used to identify leaked passwords across block storage and known credential databases.
- The AI-driven remediation workflow and how it turns confirmed findings into response actions.
- The pre-commit and pre-receive hook behaviour used to block secrets before they reach shared repositories.
- The cloud security platform coverage across AWS, Azure, Google Cloud, Oracle Cloud, Alibaba Cloud, and Kubernetes.
👉 Read Orca Security’s analysis of leaked passwords and cloud credential risk →
Leaked passwords in cloud environments: are IAM controls keeping up?
Explore further
12/06/2026 9:09 am
Leaked passwords are not just compromised secrets. They are identity events that collapse the assumption that authentication and authorization can be separated after exposure. Once a password is public, the environment must treat that credential as an active access path, not a static secret. The practical implication is that credential monitoring belongs in IAM governance, not only in security tooling operations.
A few things that frame the scale:
- it takes just two minutes for exposed secrets on GitHub to be discovered and exploited, according to the Secret Sprawl Challenge.
- In our 2024 research, 72% of organisations said they have experienced or suspect a breach of non-human identities, with 46% confirming at least one breach.
A question worth separating out:
Q: Should teams use JIT access to reduce the impact of leaked passwords?
A: Yes, when the account would otherwise carry persistent elevation. JIT reduces the amount of time a stolen credential can be used for high-risk actions, which shrinks blast radius. It works best when paired with least privilege, strong logging, and rapid revocation of unnecessary standing access.
👉 Read our full editorial: Leaked passwords are still a cloud identity problem, not just a breach issue
