Fourteen Incidents, One Table: Where the Last Mile Broke
Fourteen identity breaches from this series in one table — the way in, what looked under control, the unowned work that actually failed, and who caught it. The pattern is hard to miss once they line up.
I have written up these incidents one at a time, on purpose — each one deserves to be read on its own terms, without a thesis bolted on. But after fourteen of them a shape is impossible to ignore, and the honest way to show it is to stop narrating and put them side by side.
So here they are in a single grid. Four questions per row: how the attacker got in, what the victim reasonably believed was under control, the residual work that nobody owned and that actually decided the outcome, and who noticed. Read down the last two columns first.
| Incident | The way in | Looked "under control" | The unowned work that failed | Who caught it |
|---|---|---|---|---|
| Okta / Sitel · 2022 | RDP on a support subcontractor's laptop | Okta's own MFA monitoring — it fired in hours | Telling downstream customers; tenant-level alerting on privileged changes | Okta caught the intrusion; customers heard ~2 months later |
| 0ktapus / Twilio · 2022 | SMS phish relaying a live MFA code | "MFA is enabled" | Phishing-resistant MFA the page can't replay | Hardware-key holders simply couldn't be phished |
| Uber · 2022 | MFA-fatigue push bombing on a contractor | MFA on the account | A PowerShell script with a hardcoded PAM admin password | Attacker announced himself in Slack |
| CircleCI · 2023 | Infostealer lifted a 2FA-backed session cookie | 2FA was on | Long-lived stored secrets; session-to-device binding | A customer spotted odd OAuth in their own GitHub |
| LastPass · 2023 | Keys reachable through an engineer's home PC | The vault was encrypted | Securing the residual high-privilege endpoint; backup-access alerts | Disclosed months after the window closed |
| Storm-0558 · 2023 | A leaked signing key + a failed scope check → forged tokens | Token auth itself — forged tokens verify cleanly | Downstream mail-access logs, often behind a paid tier | A customer, via detailed access logs |
| MGM / Caesars · 2023 | A help-desk call → MFA reset to the wrong person | A modern MFA stack — never touched | A harder recovery flow for privileged accounts | Noticed at impact — ~10 days of outage |
| Okta support · 2023 | A session token stolen from the support case system | Okta's support portal | Customer-side session replay / anomaly detection | BeyondTrust and Cloudflare told Okta first (~2.5 weeks) |
| Midnight Blizzard · 2024 | Password spray on a forgotten test account (no MFA) | "Every account has MFA" | Dormant accounts and an over-permissioned OAuth app | ~7 weeks of low-and-slow before detection |
| Snowflake · 2024 | Old stolen passwords reused where MFA was optional | "The platform is secure" | Making MFA mandatory; auditing password-only logins | ~165 customers; new-location login signal |
| UNC6040 / Salesforce · 2025 | An employee authorized a malicious connected app | Passwords and tokens — none were stolen | OAuth consent control: admin approval or allow-list | Data already exfiltrated through the app |
| M&S / Co-op · 2025 | Service-desk social engineering — the MGM playbook | A modern stack, again | Privileged recovery at an outsourced service desk | A 46-day online outage; hundreds of millions of pounds |
| Salesloft Drift · 2025 | One stolen integration's OAuth tokens | Human logins — this wasn't one | Monitoring non-human identities the way you watch people | ~700 downstream orgs; a quiet dwell first |
| Vercel / AI tool · 2026 | A forgotten OAuth token to an AI tool; the vendor got infostealer'd | Nothing "broke" — the attacker logged in | Lifecycle and revocation of standing third-party grants | The token sat ~6 weeks before it was used |
Four things the grid says out loud
The front door almost never failed. Scan the third column. In nearly every row the authentication system did exactly what it was sold to do — MFA was on, the vault was encrypted, the tokens verified, the IdP was never breached. The compromise lived one layer over, in work that the product does not do for you: a reset procedure, a consent screen, a dormant account, a script on a share, a token nobody revoked. "Deployed" and "working" turned out to be separated by a stretch of operational labor with no owner. That stretch is the whole subject of this series.
The customer kept catching the vendor's breach — sometimes only if they'd paid for it. Look at who noticed. CircleCI's clearest early signal was a customer watching their own GitHub. BeyondTrust and Cloudflare told Okta it was breached, not the other way around. Storm-0558 was catchable only in downstream mail logs — which plenty of victims didn't have, because the logging was gated behind a premium tier. The lesson repeats: independent detection on your own identity events is not a feature your vendor ships you. It belongs to whoever operates identity for you, continuously, across enough surface to know what normal looks like.
The identity that failed increasingly had no human behind it. Uber's hardcoded PAM credential, Midnight Blizzard's forgotten OAuth app, Storm-0558's signing key, the Salesloft integration, the Salesforce consent grant, the Vercel AI token — these are non-human identities, and the back half of the table is full of them. Machine credentials get provisioned once, granted broad scope, and then outlive the context that justified them. No joiner-mover-leaver process watches them. They are the cleanest example of standing access that nobody owns, and they are where the recent incidents cluster.
Recovery is a control that isn't on the architecture diagram. MGM in 2023 and M&S in 2025 are, functionally, the same phone call two years apart: someone talked a help desk into handing over an identity, and the modern stack behind it never got a vote. You can buy the best authentication on the market and still lose to the reset path beside it, especially when that path is outsourced to a service desk measured on ticket-close time. The recovery flow is where a lot of these stories actually end, and it's the part least likely to appear in a security review.
The columns vary. The way in is sometimes a phone call, sometimes malware, sometimes a forged token. What looked under control is sometimes MFA, sometimes a vault, sometimes the platform itself. But one column is populated in every single row, and it's the same column: the work that makes identity actually hold, that has no owner. That's not a coincidence across fourteen incidents. It's the job.