Why do compromised accounts create outsized risk in public-interest organisations?

Why one compromised account can disrupt an entire public-interest mission

A compromised account is rarely just one user problem in a public-interest organisation. Mailboxes, admin consoles, shared drives and collaboration platforms often sit at the centre of public communication and casework, so attackers can exploit the trust already attached to that account. The result is usually operational disruption, reputational damage and broader loss of confidence, not a narrow account-level incident.

Which account types make the blast radius so large?

The accounts that matter most are the ones that sit on a trust path. Executive mailboxes, finance approvers, domain admins, help desk accounts and shared service identities can all connect to many people and many systems. If one of those is taken over, the attacker can reset passwords, approve requests, impersonate staff or redirect conversations in ways that ordinary endpoint controls may not stop quickly.

That is why the same compromise can look minor in logs but major in business impact. In a public-interest setting, the account is often a coordination point for external partners, donors, clients, regulators or citizens, so misuse of that identity can affect service delivery and decision-making across the organisation. A compromised cloud account used for crypto-mining shows how quickly one stolen credential can be turned into large-scale abuse when privilege is broad enough.

Why compromise of trust-bearing accounts is harder to contain

Public-interest organisations often rely on continuity and shared access, which means a compromised account may already be trusted by people, systems and partners. An attacker can use that trust to send believable messages, alter records, request urgent exceptions or move laterally into other tools that share the same identity source. Once the account is trusted, defenders have to prove abuse before they can safely restore confidence.

Compromise also becomes more damaging when the account has downstream privileges that are not obvious to the user themselves. A mailbox may grant access to password resets; a project account may expose shared documents; an admin account may control directories, endpoints or cloud resources. That pattern is visible in campaigns such as the GhostAction campaign, where compromised accounts were used to plant malicious workflows and exfiltrate secrets from many repositories.

Risk and Threat Considerations

Public-interest organisations are especially exposed because attackers can convert one compromised account into trust abuse, service interruption or silent manipulation of communications. The practical danger is not just theft of data, but the loss of integrity in messages, approvals and access decisions that other teams depend on.

Failure mechanism: Weak authentication, reused secrets or excessive privilege let an attacker turn one account into a platform for impersonation, lateral movement or control-plane access.

Impact: The organisation may face disrupted services, fraudulent instructions, blocked access to shared systems, delayed casework and reduced public trust.

Practitioner Guidance

What to prioritise: Start with accounts that can influence many others, especially mailboxes, directory admins, finance approvers and shared service identities. If an account can reset access, approve actions or publish on behalf of the organisation, treat it as high blast radius even if it is used by one person.

What to verify: Confirm which accounts have cross-system authority, delegated mailbox access, password reset paths or cloud/admin roles. The key question is whether compromise of that identity can create new access, not just whether the user can log in.

Common mistake: Teams often focus on the infected endpoint or the suspicious message and underreact to the identity that made the message believable. In these cases, identity containment and session revocation matter more than a simple device cleanup.

Practitioner takeaway: In public-interest environments, account risk is amplified by trust and shared responsibility, so containment should be driven by privilege and reach, not by the number of users on the account.

Related resources from NHI Mgmt Group

• Why do non-human identities create more audit risk than human accounts?
• Why do compromised maintainer accounts and mutable pipeline dependencies create outsized risk?
• Why do compromised employee accounts create outsized risk for banking data exposure and downstream fraud?
• Why do compromised service accounts and build credentials create outsized risk in supply chain environments?