Vector: TeamPCP (UNC6780) leveraged credentials stolen via the March 2026 Trivy vulnerability scanner supply chain compromise to breach Cisco's internal development and build environment via a malicious GitHub Action plugin

Vector: Attackers compromised the open-source security tool Trivy in a supply chain attack; a secret AWS API key associated with the European Commission's account was embedded in Trivy data and extracted by ShinyHunters, enabling access to the EC's AWS cloud environment

Vector: TeamPCP (UNC6780) exploited a misconfigured GitHub Actions workflow in Aqua Security's Trivy vulnerability scanner repository, compromising the aqua-bot service account to execute an imposter commit attack that force-pushed malicious code to 76 of 77 version tags across aquasecurity/trivy-action and aquasecurity/setup-trivy

Vector: Threat actor compromised an Okta SSO account belonging to a support agent at Telus (Crunchyroll's BPO partner); malware on the employee's device harvested credentials used to access Crunchyroll's support ticket system

Vector: UNC6426 leveraged credentials (GitHub Personal Access Token) stolen during the 2025 nx npm package supply chain compromise to abuse GitHub-to-AWS OpenID Connect (OIDC) trust, escalating from a developer PAT to full AWS AdministratorAccess within 72 hours

Vector: ShinyHunters maintained persistent access to Anodot's (an AI analytics SaaS integrator) infrastructure and stole authentication tokens used to connect Anodot to downstream customer Snowflake environments

Vector: ShinyHunters compromised an Okta SSO account to access Hims & Hers' Zendesk customer support instance

Vector: DOGE (Department of Government Efficiency) transferred sensitive Social Security Administration data to an external cloud server without standard federal data security controls

Vector: ShinyHunters used vishing (voice phishing) to compromise IT support at a third-party vendor (believed to be Salesforce) used by Betterment for marketing and customer communications, gaining access to third-party software platforms

Vector: ShinyHunters discovered Google Cloud Platform credentials for Telus Digital embedded in a Drift data export; used those credentials to access BigQuery, then pivoted using additional secrets found with trufflehog to access further systems

Vector: Unauthorized actor transferred files from Eurail's AWS S3 buckets, Zendesk instance, and GitLab repositories on December 26, 2025; initial access vector not disclosed

Vector: ShinyHunters used vishing (voice phishing) to trick SoundCloud employees into providing access credentials to an ancillary service dashboard rather than the company's core production systems

Vector: Misconfiguration: IDMerit left a MongoDB database containing KYC identity verification records publicly accessible on the internet without authentication

Vector: Threat actors compromised Mixpanel's product analytics platform infrastructure, gaining access to customer behavioral and analytics data that dozens of companies had shared with Mixpanel for product improvement and user analytics purposes

Vector: Crimson Collective gained unauthorized access to Red Hat's internal consulting GitLab instance used for customer engagement collaboration, exfiltrating approximately 570GB of compressed data from over 28,000 repositories

Vector: Compromise of third-party service provider / vendor relationship

Vector: Compromise of third-party service provider / vendor relationship

Vector: Compromise of third-party service provider / vendor relationship

Vector: Compromise of third-party service provider / vendor relationship

Vector: UNC6395 compromised Salesloft's Drift AI chatbot integration and stole OAuth authentication tokens used to connect Drift with downstream customer Salesforce, Google Workspace, and Slack environments

Vector: Compromise of third-party service provider / vendor relationship

Vector: Compromise of third-party service provider / vendor relationship

Vector: Compromise of third-party service provider / vendor relationship

Vector: Compromise of third-party service provider / vendor relationship

Vector: Compromise of third-party service provider / vendor relationship

Vector: Compromise of third-party service provider / vendor relationship

Vector: Compromise of third-party service provider / vendor relationship

Vector: Vishing / social engineering: attackers impersonated IT helpdesk to trick an employee or vendor into granting access to a cloud-based Salesforce CRM system; Salesforce Data Loader used to bulk-exfiltrate data

Vector: ShinyHunters (Scattered Lapsus$ Hunters) used vishing (voice phishing) to impersonate IT support staff, tricking employees into visiting Salesforce's connected app setup page and entering a 'connection code' that linked a malicious OAuth app (malicious Salesforce Data Loader) to the employee's Salesforce environment

Vector: ShinyHunters compromised Cisco's Salesforce CRM environment through social engineering / vishing of a Salesforce-privileged employee, part of the broader 2025 ShinyHunters Salesforce campaign

Vector: ShinyHunters compromised Pandora and Chanel's Salesforce CRM environments through social engineering / vishing, part of the broader 2025 ShinyHunters Salesforce campaign targeting major brand CRM instances

Vector: ShinyHunters compromised Stellantis's Salesforce environment through vishing/social engineering of a Salesforce-privileged user, part of the broader 2025 ShinyHunters Salesforce campaign

Vector: ShinyHunters and Scattered Spider breached a third-party vendor (believed to be Salesforce) used by Farmers Insurance, gaining unauthorized access to a database containing customer information

Vector: CWE-22: Path Traversal (CVE-2024-57727) and CWE-269: Improper Privilege Management (CVE-2024-57726)

Vector: CWE-121: Stack-based Buffer Overflow (CVE-2025-22457 — stack buffer overflow in Ivanti Connect Secure enabling remote code execution)

Vector: Compromise of third-party service provider / vendor relationship

Vector: CWE-287: Improper Authentication (single sign-on (SSO) service compromised; insider/former student gained unauthorised access)

Vector: Attacker used stolen credentials to access legacy Cerner EHR servers that had not yet been migrated to Oracle Cloud; CVE-2025-30154 exploited in related Oracle infrastructure

Vector: A threat actor known as 'rose87168' claimed to have exploited a vulnerability in Oracle Cloud's login infrastructure (login.oracle.com / Oracle Identity Manager) to access Oracle's SSO and LDAP systems, exfiltrating approximately 6 million records including encrypted SSO passwords, LDAP password hashes, and JKS files

Vector: Compromise of third-party service provider / vendor relationship

Vector: Compromised credentials of a third-party service provider / contractor with access to Grubhub's internal systems

Vector: CWE-121: Stack-based Buffer Overflow (CVE-2025-0282 — unauthenticated stack-based buffer overflow enabling RCE)

Vector: Compromised credentials and vulnerabilities in Orange Romania's Jira software and internal portals; attacker had access for over one month

Vector: Compromise of third-party service provider / vendor relationship

Vector: Misconfiguration: Serviceaide left an Elasticsearch database containing Catholic Health patient PHI publicly accessible on the internet without authentication for approximately six weeks

Vector: Compromise of third-party service provider / vendor relationship

Vector: Threat actors compromised Otelier's hotel management SaaS platform by stealing credentials through an infostealer malware infection, then used those credentials to access Otelier's Atlassian systems and AWS S3 buckets containing hotel customer reservation data

Vector: Chinese company Funnull CDN acquired the polyfill.io domain and associated GitHub repository from its original maintainer in early 2024; subsequently modified the polyfill.js script served by cdn.polyfill.io to inject malicious code that redirected mobile users to scam and malicious sites, with obfuscation to avoid detection

Vector: Compromise of third-party service provider / vendor relationship

Vector: Compromise of third-party service provider / vendor relationship

Vector: CWE-522: Insufficiently Protected Credentials (infostealer-harvested credentials, no MFA on Snowflake)

Vector: CWE-522: Insufficiently Protected Credentials (infostealer-harvested credentials, no MFA on Snowflake)

Vector: Attacker gained access to a Dropbox Sign automated system configuration tool, using it to execute code in the context of the Sign application; this provided access to the customer database and to application-related secrets including API keys, OAuth tokens, and MFA keys/seeds

Vector: CWE-307: Improper Restriction of Excessive Authentication Attempts (stolen credentials reused against Snowflake tenant with no MFA)

Vector: CWE-307: Improper Restriction of Excessive Authentication Attempts (stolen credentials reused against Snowflake tenant with no MFA)

Vector: CWE-307: Improper Restriction of Excessive Authentication Attempts (stolen credentials reused against Snowflake tenant with no MFA)

Vector: CWE-307: Improper Restriction of Excessive Authentication Attempts (stolen credentials from infostealer malware reused against Snowflake tenant with no MFA)

Vector: CWE-307: Improper Restriction of Excessive Authentication Attempts (stolen credentials reused against Snowflake tenant with no MFA)

Vector: UNC5537 used infostealer-harvested credentials to access Neiman Marcus's Snowflake cloud environment without MFA

Vector: UNC5537 (Scattered Spider) used infostealer-harvested credentials to access AT&T's Snowflake cloud environment without MFA; attackers exfiltrated call and SMS metadata records between 14-25 April 2024

Vector: CWE-522: Insufficiently Protected Credentials (infostealer-harvested credentials used against Snowflake instances lacking MFA)

Vector: CWE-522: Insufficiently Protected Credentials (infostealer-harvested credentials, no MFA on Snowflake account)

Vector: UNC5537 (Scattered Spider / ShinyHunters) used credentials harvested by infostealer malware (Lumma, Vidar, RedLine, RisePro, Raccoon) to log into Snowflake customer accounts that lacked MFA; no breach of Snowflake's own platform

Vector: CWE-307: Improper Restriction of Excessive Authentication Attempts (stolen credentials reused against Snowflake tenant with no MFA)

Vector: Third-party cloud platform compromise; likely Snowflake credential theft via infostealer malware (not officially confirmed by TEG); ShinyHunters linked

Vector: Stolen credentials (via infostealer malware) used to access LAUSD vendor Snowflake account with no MFA configured; part of the broader UNC5537 Snowflake credential campaign

Vector: Malicious file (trojanised AI art program) distributed via GitHub; credential theft from victim's 1Password password manager

Vector: Authentication bypass vulnerability (CVE-2024-1709, CVSS 10.0) in ConnectWise ScreenConnect — a widely-used remote desktop and access tool used by managed service providers (MSPs) — allowed unauthenticated remote attackers to bypass authentication and create new administrator accounts, leading to complete system compromise; a second path traversal vulnerability (CVE-2024-1708) also existed; multiple ransomware groups and nation-state actors exploited the vulnerabilities within hours of disclosure

Vector: Attackers gained access to Sisense's self-hosted GitLab code repository, found credentials/tokens granting access to Sisense's Amazon S3 buckets in the cloud, and exfiltrated customer access tokens, API keys, passwords, and certificates

Vector: Amazon Web Services (AWS) cloud storage misconfiguration: data left unencrypted and publicly accessible in S3 buckets managed by Volkswagen's software subsidiary CARIAD

Vector: CWE-305: Authentication Bypass by Primary Weakness chained with CWE-77: Command Injection

Vector: CWE-287: Improper Authentication (stolen access tokens and service account credentials from Okta October 2023 breach reused; Cloudflare failed to rotate them)

Vector: A threat actor used a compromised AWS access key credential belonging to Sumo Logic to gain unauthorized access to Sumo Logic's AWS infrastructure

Vector: Compromise of third-party service provider / vendor relationship

Vector: A Mercedes-Benz employee inadvertently included a GitHub API token in a public GitHub repository; the token provided unrestricted read access (with no expiration date) to the entire Mercedes-Benz Enterprise GitHub organization, allowing access to all private repositories

Vector: Attacker used a stolen credential to access Okta's customer support case management system (Salesforce Service Cloud); the credential was compromised because an Okta employee had signed into their personal Google account on a work device, and the credential was stored in the personal Google account which was later breached

Vector: CWE-522: Insufficiently Protected Credentials (employee personal Google account compromise exposing corporate credentials)

Vector: CWE-1391: Use of Weak Credentials (social engineering via LinkedIn identity theft + vishing helpdesk to bypass Okta MFA)

Vector: Smart contract exploit / hack

Vector: CWE-1390: Weak Authentication (vishing / voice phishing social engineering of outsourced IT vendor to bypass Okta MFA)

Vector: CWE-287: Improper Authentication (forged authentication tokens using a stolen Microsoft MSA consumer signing key; used to access Exchange Online accounts across enterprise and personal tenants)

Vector: Compromise of third-party service provider / vendor relationship

Vector: Compromise of third-party service provider / vendor relationship

Vector: CircleCI's January 2023 breach (malware on engineer laptop stole session token) allowed attackers to access CircleCI customer secrets; Datadog's RPM package signing key was stored in CircleCI CI/CD environment variables and was exposed

Vector: Attackers used social engineering to target Mailchimp customer-facing operations staff, obtaining credentials to access internal tools used by Mailchimp's customer support and account administration teams; the attackers then used this access to view and export customer list data

Vector: Attackers used social engineering to target Mailchimp customer-facing operations staff, obtaining credentials to access internal tools used by Mailchimp's customer support and account administration teams; the attackers then used this access to view and export customer list data

Vector: Malware was deployed on a CircleCI engineer's laptop that had access to production systems; the malware stole a valid session cookie and bypassed 2FA, allowing the attacker to impersonate the engineer's session; the attacker then exfiltrated customer data and encryption keys from CircleCI's production infrastructure

Vector: A publicly accessible Jenkins CI/CD server misconfiguration at CommuteAir exposed AWS credentials, which a security researcher used to access multiple S3 buckets — including one containing the TSA's No Fly List

Vector: Attacker used information stolen in the August 2022 LastPass breach (source code and technical data) to target a senior LastPass DevOps engineer at home; exploited a vulnerable third-party media software package on the engineer's personal computer to install a keylogger; captured the employee's master password and MFA credentials to access their LastPass corporate vault; then accessed a LastPass AWS S3 cloud backup containing encrypted customer password vaults

Vector: Attackers (believed to be either FTX insiders or nation-state actors) accessed AWS infrastructure secrets and private key material for multiple FTX-affiliated entities shortly after FTX filed for bankruptcy, draining approximately $400M from FTX and related exchange wallets

Vector: CWE-1232: Improper Lock of Memory That Contains Resource (developer laptop compromise via malware; second stage via vulnerable Plex Media Server CVE-2020-5741)

Vector: SMS phishing (smishing) of employee credentials leading to downstream supply chain compromise

Vector: Attackers used social engineering to target Mailchimp customer-facing operations staff, obtaining credentials to access internal tools used by Mailchimp's customer support and account administration teams; the attackers then used this access to view and export customer list data

Vector: 0ktapus / Scattered Spider threat actors phished an employee of an unnamed third-party vendor with access to DoorDash systems via SMS phishing (smishing), then used the stolen credentials to access DoorDash's internal tools and customer data

Vector: Compromise of third-party service provider / vendor relationship

Vector: CWE-1021: Improper Restriction of Rendered UI Layers (SMS phishing / smishing with real-time OTP relay to fake login page)

Vector: An attacker obtained stolen OAuth user tokens issued to Heroku and Travis CI (two third-party GitHub integrations); used the tokens to enumerate and download private GitHub repositories for organizations that had granted these integrations OAuth access; then used credentials found in those repositories to access downstream systems

Vector: Compromise of third-party service provider / vendor relationship

Vector: CWE-1391: Use of Weak Credentials (third-party support contractor workstation compromise via RDP + credential harvesting)

Vector: Misconfigured publicly accessible Amazon S3 bucket containing Pegasus Airlines' Electronic Flight Bag (EFB) software — airline operational data systems — was discovered by SafetyDetectives researchers; the bucket required no authentication to access

Vector: An AWS IAM access key was inadvertently exposed in a publicly accessible Football Australia S3 bucket, enabling unauthorized access to backend systems and customer data spanning football players and fans

Vector: Anonymous actor (posting as 'Anonymous' on 4chan) claimed a server misconfiguration allowed access to Twitch's internal Git repositories; the attacker obtained credentials or tokens that granted access to Twitch's internal infrastructure

Vector: Server misconfiguration — Twitch stated the data was exposed due to an error in a Twitch server configuration change; the specific nature of the misconfiguration was not detailed, but the attacker accessed and exfiltrated data from Twitch's internal Git repositories and infrastructure

Vector: Wiz.io researchers discovered a chain of vulnerabilities in Azure Cosmos DB's Jupyter Notebook integration that allowed complete access to any Azure Cosmos DB customer's database — without any action required from the victim; the vulnerability enabled attackers to read, write, and delete data in Cosmos DB accounts belonging to any Azure customer

Vector: Compromise of third-party service provider / vendor relationship

Vector: CWE-89: SQL Injection in Kaseya VSA web interface (zero-day)

Vector: REvil exploited multiple zero-day vulnerabilities in Kaseya VSA (CVE-2021-30116, CVE-2021-30119, CVE-2021-30120) to push malicious script execution to all managed endpoints without authentication; exploitation was conducted over the Independence Day holiday weekend

Vector: UNC2903 exploited Server-Side Request Forgery (SSRF) vulnerabilities in web applications running on AWS EC2 instances to query the IMDSv1 (Instance Metadata Service v1) endpoint at 169.254.169.254, retrieving temporary IAM role credentials without authentication

Vector: Compromise of third-party service provider / vendor relationship

Vector: Microsoft Power Apps portals defaulted to allowing public table access; organizations inadvertently exposed internal databases containing PII because Microsoft's default configuration required administrators to explicitly disable public access — a non-intuitive security posture that many missed

Vector: CWE-506: Embedded Malicious Code — attackers hijacked Passwordstate's In-Place Upgrade CDN endpoint to serve trojanized update containing Moserpass infostealer

Vector: Compromise of third-party service provider / vendor relationship

Vector: Attackers (led by Swiss hacker Tillie Kottmann / 'deletescape') found 'Super Admin' credentials for Verkada's cloud video platform in a publicly accessible Jenkins server; used them to gain root access to all 150,000 cameras across thousands of Verkada's enterprise customers

Vector: Attacker exploited a flaw in Codecov's Docker image creation process that allowed extraction of credentials from Codecov's Google Cloud Storage bucket; used these to modify the bash uploader script distributed to CI/CD pipelines; the tampered script exfiltrated CI environment variables (secrets, tokens, keys) to attacker-controlled server

Vector: CWE-506: Embedded Malicious Code — attackers exploited a Docker image build flaw in Codecov's CI pipeline to insert a credential-harvesting curl command into the Bash Uploader script

Vector: Unknown attacker gained access to 20/20 Eye Care Network's AWS environment and accessed and deleted files stored in S3 buckets containing member information; 20/20 discovered the deletion and was unable to determine whether data was exfiltrated prior to deletion

Vector: Compromise of third-party service provider / vendor relationship

Vector: Socialarks — a Chinese social media management company — left an Elasticsearch database exposed publicly without authentication; the database contained scraped and aggregated social media profile data collected by Socialarks from LinkedIn, Facebook, Instagram, and other platforms

Vector: Multiple Chinese APT groups (UNC2630 / APT5, and others) exploited CVE-2021-22893 and related zero-day vulnerabilities in Pulse Connect Secure VPN appliances to gain unauthorized access to targeted organizations' networks without authentication

Vector: Senior cloud engineer at Ubiquiti used his legitimate privileged AWS and GitHub access to clone the company's source code repositories and steal customer data, then used a VPN to disguise his identity while extorting the company

Vector: Russia SVR/Cozy Bear/APT29 compromised SolarWinds' Orion software build pipeline and injected the SUNBURST backdoor into legitimate Orion updates, signed with SolarWinds' code signing certificate and distributed to ~18,000 organizations

Vector: Russian SVR (Cozy Bear / UNC2452) compromised FireEye via the SUNBURST backdoor in a trojanized SolarWinds Orion update — the same supply chain attack as the broader SolarWinds campaign; FireEye was the first organization to detect and publicly disclose the SUNBURST backdoor

Vector: Misconfigured Elasticsearch cluster left publicly accessible without authentication

Vector: Attackers compromised AWS IAM user credentials associated with Cisco WebEx's infrastructure, gaining access to Cisco's cloud environment and exfiltrating data before the intrusion was detected

Vector: Compromise of third-party service provider / vendor relationship

Vector: Razer's customer data was inadvertently exposed through a misconfigured Elasticsearch cluster that was publicly accessible without authentication; the misconfiguration was set up by a vendor and the public exposure lasted approximately one month before being discovered

Vector: Attacker found Drizly AWS credentials stored in an unsecured GitHub repository (accessible to all Drizly employees), used them to access an RDS database containing 2.5 million customer records

Vector: Compromise of third-party service provider / vendor relationship

Vector: Credential stuffing using credentials from previously breached services — attackers compiled email/password combinations from unrelated data breaches and tested them against Zoom accounts, successfully accessing accounts where users had reused passwords

Vector: CWE-506: Embedded Malicious Code inserted into SolarWinds Orion build pipeline

Vector: Misconfigured Elasticsearch production logging database left publicly accessible on the internet without authentication; no malicious actor required — the data was fully open to anyone who found the server

Vector: A First Republic Bank employee with legitimate AWS access used their credentials to exfiltrate customer data from AWS-hosted banking systems

Vector: Credential stuffing — attackers used large lists of username/password combinations from prior unrelated data breaches to attempt automated logins to Zoom accounts; successful matches were then compiled and sold

Vector: Security researcher Jeremiah Fowler discovered that Estée Lauder's internal Elasticsearch database was publicly accessible without any authentication or password protection; the database contained internal records and email addresses

Vector: Compromise of third-party service provider / vendor relationship

Vector: REvil (Sodinokibi) exploited CVE-2019-11510, a critical path traversal vulnerability in Pulse Secure VPN that allowed unauthenticated remote file reading, including cached plaintext VPN credentials; patch had been available since April 2019

Vector: Compromise of third-party service provider / vendor relationship

Vector: Security researchers at vpnMentor discovered that Suprema's BioStar 2 web-based security platform had a publicly accessible, unprotected Elasticsearch database; the database was accessible without authentication and contained the biometric and security management data for the platform's clients

Vector: An unauthorized attacker gained access to a cloud server used by MGM Resorts and extracted guest data; MGM had stored the data in a cloud server that was accessible without proper authentication controls; the breach was not discovered until ZDNet reporter Catalin Cimpanu was alerted to the data being circulated on a hacking forum

Vector: Unauthorized access to a database storing a subset of non-financial Docker Hub user data; Docker stated the database was accessed without authorization but did not disclose the specific attack vector

Vector: Paige Thompson (former AWS engineer) exploited a Server-Side Request Forgery (SSRF) vulnerability in a misconfigured AWS WAF to reach the EC2 Instance Metadata Service (IMDSv1) endpoint, stealing temporary IAM role credentials; used those credentials to access 700+ S3 buckets containing Capital One customer data

Vector: Verifications.io, an email verification service, left an Elasticsearch database containing 763 million records exposed publicly on the internet without authentication; the database was discovered by security researchers Bob Diachenko and Vinny Troia

Vector: Misconfigured AWS S3 bucket publicly exposing 409 GB of sensitive financial and identity data

Vector: Misconfigured AWS S3 bucket exposing 7GB of sensitive medical records and patient-doctor audio recordings

Vector: Misconfigured Amazon S3 bucket created by an AWS salesperson with public read permissions — the bucket named "abbottgodaddy" was created to store pricing proposal documents for a GoDaddy AWS engagement and was not locked down to account-owner-only access as required by best practice

Vector: SMS interception bypassing two-factor authentication on employee cloud and source code hosting accounts

Vector: Exactis, a data broker, left a 2TB Elasticsearch database publicly accessible on the open internet with no authentication required; discovered by security researcher Vinnie Troia

Vector: Unsecured Apache Airflow server deployed by contractor without authentication

Vector: Unknown attacker compromised PageUp People's cloud-based HR and recruitment platform; PageUp described it as unusual activity in its IT infrastructure suggesting a malware infection; the platform stored candidate and employee data for over 100 Australian and global employers

Vector: Malware infection of PageUp's systems; PageUp detected unusual activity on May 23, 2018 and confirmed malware had compromised some of its infrastructure; the precise initial intrusion vector (e.g., spearphishing, unpatched vulnerability) was not publicly disclosed

Vector: A contract worker with knowledge of the credentials used Chegg's AWS root account credentials and shared access keys to access an S3 bucket containing user data, exfiltrating records for 40 million users

Vector: LA Times' Amazon S3 bucket hosting the Homicide Report web application was publicly writable due to misconfigured S3 ACLs; attackers injected Coinhive cryptocurrency mining JavaScript into the page

Vector: Imperva's internal database migration process created an Amazon RDS snapshot and made it publicly accessible; the snapshot contained customer authentication tokens, password hashes, and API keys. An attacker later found and accessed this snapshot

Vector: Misconfigured Amazon S3 bucket left publicly accessible without authentication

Vector: Deep Root Analytics, a data analytics firm contracted by the Republican National Committee, misconfigured an Amazon S3 bucket that was set to public access; the bucket contained detailed voter data compiled from multiple sources including publicly available voter registration records, proprietary commercial data, and political modeling scores

Vector: Unsecured Amazon S3 bucket with no access controls or authentication

Vector: NICE Systems — an Israel-based enterprise software company contracted by Verizon for call center quality improvement — misconfigured an Amazon S3 bucket to be publicly accessible; the bucket contained customer account data from Verizon's customer call center operations

Vector: Attacker obtained access keys to the AWS platform used by OneLogin's US data region via an unknown mechanism, then used those keys to create AWS API calls to enumerate OneLogin's infrastructure and access customer data; the attacker used AWS API access to decrypt data stored in OneLogin's environment

Vector: Unauthorized access to Zendesk Support and Chat customer account databases; breach originated in 2016 and disclosed to affected customers in October 2019

Vector: Credential stuffing attack on Uber engineers' GitHub accounts using passwords from prior breaches; AWS access keys found in private repositories

Vector: CWE-312: Cleartext Storage of Sensitive Information (AWS credentials exposed in GitHub repository, used to access S3 bucket with customer data)

Vector: Attackers found Uber's private GitHub repository containing hardcoded AWS credentials; used those credentials to access an AWS S3 bucket containing a backup archive with rider and driver personal data; attackers contacted Uber and demanded $100,000 in exchange for deleting the data

Vector: A bug in Cloudflare's HTML parser (introduced 22 September 2016) caused the parser to read past the end of a buffer when processing certain HTML constructs (including server-side includes, email obfuscation, and automatic HTTPS rewrites); the overrun memory contained data from other Cloudflare customers' HTTP requests including authentication tokens, session cookies, passwords, and private messages — this data was served in HTTP responses to users and cached by Google, Bing, and other search engines

Vector: An attacker gained access to DataDog's internal systems and obtained AWS access keys, which could have been used to access customer AWS environments where the DataDog agent was installed

Vector: Vitagene left Amazon S3 buckets containing customer raw DNA data and health profile files publicly accessible without authentication, with no CloudTrail logging enabled to detect unauthorized access

Vector: Unknown attacker compromised LastPass's network and gained access to the LastPass database; specific intrusion vector was not disclosed; the attacker accessed user account email addresses, password reminders, server per-user salts, and authentication hashes

Vector: An old, forgotten AWS access key from a former employee's prototype environment was discovered by an attacker and used to access BrowserStack's production customer database in Amazon S3

Vector: Attacker gained access to Code Spaces' AWS management console (EC2 control panel) using stolen credentials, then launched a DDoS attack and demanded payment; when Code Spaces attempted to regain control, the attacker systematically deleted all EC2 instances, S3 buckets, EBS snapshots, and machine images

Vector: An Uber software engineer stored AWS credentials in a private GitHub repository; the repository was accessed by a third party who used the credentials to access an Amazon S3 bucket containing the driver database backup; the third party used the AWS access to download approximately 50,000 driver names and licence numbers

Vector: Misconfigured Toyota Connected cloud environment exposed vehicle location data to the public internet; the data was stored in a cloud environment (managed by Toyota's subsidiary Toyota Connected) with misconfigured access controls that made it publicly accessible without authentication for approximately 10 years

Vector: Cloud misconfiguration — Toyota's connected vehicle cloud environment was configured to be publicly accessible without authentication; the misconfiguration resulted from 'insufficient explanation and thoroughness of data handling rules' causing data not to be stored with appropriate access controls

Vector: Misconfigured AWS S3 bucket left publicly accessible without authentication; contained hotel reservation records dating back to 2013

Vector: A Dropbox employee reused their LinkedIn password for their Dropbox work account; when the 2012 LinkedIn breach exposed that password, attackers used it to log into the employee's Dropbox work account, which contained a document with hashed Dropbox user passwords