Case studies from recent high-impact breaches—and the concrete controls that would have changed the outcome
Why these cases matter
Breaches aren’t abstract. Each headline maps to very specific control failures you can prevent: missing MFA on remote access, weak vendor governance, unpatched edge software, over-privileged tokens, and thin detection engineering. Below are six recent, consequential incidents and the playbooks security teams can apply today.
1) Change Healthcare (UnitedHealth Group), 2024: Ransomware via remote access without MFA
What happened: The ALPHV/BlackCat group accessed Change Healthcare using stolen credentials on a Citrix remote access service that lacked MFA, leading to one of the largest healthcare data exposures on record and months of operational disruption. U.S. authorities and subsequent reporting place the impact at ~193 million people, with multi-billion-dollar response costs reported by UnitedHealth Group.
What would have changed the outcome:
- Enforce phishing-resistant MFA (FIDO2/Passkeys) on all remote access and admin paths.
- Network access control & conditional access (device posture + risk signals).
- Privileged access management (PAM) with just-in-time (JIT) elevation.
- Rapid containment playbooks: IR rehearsals, segmentation, and egress controls for exfil.
- Third-party claims/PHI logging centralized for forensics and breach scoping.
Do now: Inventory all remote access surfaces (VPN, VDI, bastions), block legacy auth, require FIDO2 for admins, and test a ransomware tabletop with finance, legal, and comms.
2) Snowflake-linked customer breaches (Ticketmaster, Santander), 2024–2025: “No MFA + stolen creds” at scale
What happened: Several high-profile Snowflake customers reported large data theft. Investigations and national advisories emphasized credential theft and lack of MFA on certain Snowflake accounts, prompting emergency guidance to enable MFA, disable unused accounts, and hunt for anomalous activity.
What would have changed the outcome:
- Enforce MFA (preferably phishing-resistant) for all human AND service accounts.
- Private connectivity (no public endpoints) plus IP allow-listing where feasible.
- Role-based, least-privilege access; rotate long-lived keys; monitor high-risk queries.
- Behavior analytics for large exports, cross-region pulls, and off-hours access.
Do now: Run a Snowflake hardening sprint: inventory accounts, mandate MFA, rotate tokens, implement data egress alerts, and set a joiner–mover–leaver automation for access.
3) MOVEit Transfer mass exploitation (2023→2024): Third-party software supply-chain exposure
What happened: CL0P exploited zero-day vulnerabilities in MOVEit Transfer, enabling mass victimization across sectors. A year later, additional MOVEit vulnerabilities emerged, underscoring the need for continuous vendor risk monitoring and rapid patching on internet-facing file-transfer tools.
What would have changed the outcome:
- SBOM awareness and threat intelligence tied to vendor products you run.
- Rapid patch orchestration for edge systems with compensating WAF rules.
- Isolation patterns: put file transfer in a sandboxed network segment with strict egress.
- Data minimization: limit what lands on transfer servers; short retention windows.
Do now: Build a “critical edge” asset list (file transfer, SSO, MDM, VPN, gateways). Subscribe to vendor advisories, pre-stage virtual patching (WAF), and exercise containment runbooks.
4) AT&T 2024 data exposure: Massive consumer dataset leaked
What happened: AT&T confirmed that AT&T-specific data appeared in a dataset posted online, later followed by legal actions tied to data exposures affecting tens of millions of customers. In 2025, news outlets reported a proposed $177M settlement related to 2024 breaches affecting ~73M and other customers, indicating the long tail of consumer data compromise.
What would have changed the outcome:
- Data lifecycle discipline: purge stale PII, tokenize wherever possible.
- Rigorous third-party risk and downstream breach notification obligations in contracts.
- Consumer data leak detection (dark-web monitoring + deterministic identity matching).
- Breach-ready comms: templated notifications, credit monitoring arrangements.
Do now: Run a data mapping + minimization project and push tokenization or format-preserving encryption for customer identifiers at rest and in transit.
5) Okta support system compromise (2023): Identity provider as an attack amplifier
What happened: Okta’s support environment was compromised; threat actors accessed a report listing customer support users’ names/emails and could misuse uploaded browser artifacts. Multiple downstream organizations reported related activity, highlighting identity platform risk and the blast radius when support workflows ingest tokens/cookies.
What would have changed the outcome:
- Hard isolation between production identity systems and support tooling.
- Token hygiene: never allow live session tokens in support uploads; enforce redaction.
- Customer-facing hardening advisories and rapid detection content (SSO anomalies).
- Scoped break-glass accounts with hardware-bound MFA.
Do now: Review your IdP tenant: disable weak factors, enable risk-based conditional access, audit support workflows, and implement tamper-evident session handling.
6) Microsoft Storm-0558 (2023): Token signing material and cloud email compromise
What happened: A China-nexus actor (Storm-0558) accessed email systems across government and private orgs. The U.S. Cyber Safety Review Board’s analysis and Microsoft’s investigation detailed issues around signing key handling and detection gaps, emphasizing assume-breach posture for identity tokens and cloud email telemetry.
What would have changed the outcome:
- HSM-backed, tightly scoped signing keys, with lifecycle controls and monitoring.
- Detections on unusual token issuance/validation paths; rich mailbox audit logs.
- Defense-in-depth for federation: verifier isolation, stringent claims validation.
Do now: Validate email and identity logging coverage, alert on suspicious consent grants, anomalous token audiences, and admin consent spikes.
Cross-cutting lessons you can implement
- Identity first: Enforce phishing-resistant MFA everywhere, remove legacy auth, move admins to PAM + JIT.
- Harden your edges: Inventory and continuously patch internet-facing systems; pre-stage WAF/virtual patching.
- Data minimization: Reduce PII sprawl; tokenize; shorten retention; restrict egress.
- Third-party reality: Treat vendors as part of your attack surface; contract for MFA, logging, and breach SLAs.
- Detection engineering: Map detections to ATT&CK, measure alert quality, and automate containment (SOAR).
- Tabletop what hurts: Ransomware, SaaS data exfil, identity provider compromise—practice the messy ones with legal, PR, and execs.
- Evidence-ready logging: Centralize high-value logs (IdP, email, edge apps, data platforms) with immutable retention.
- Privileged blast radius: Vault secrets, rotate frequently, kill long-lived tokens, and isolate signing material.
Build your roadmap (practical sequence)
Month 1: Identity hardening sprint—FIDO2 for admins, block legacy auth, PAM JIT, review support workflows.
Month 2: Edge & vendor sprint—patch/file-transfer isolation, Snowflake/SaaS MFA enforcement, egress monitoring, vendor MFA clauses.
Month 3: Data & detection sprint—tokenize PII, reduce retention, add ATT&CK-mapped detections for exfil and suspicious OAuth grants; run a ransomware tabletop.
Final word
The incidents above are not outliers; they’re patterns. Organizations that win in 2025 treat identity as the perimeter, data as the crown jewels, and detection as a product—with rehearsed incident playbooks. If you want a guided path, our programs at Infosec Simplified pair hands-on labs with exam-aligned training (CISA, CISM, CRISC, CISSP) and implementation blueprints you can take back to work the same week.
Ready to turn lessons into resilience?
Join the next cohort—let’s build the controls that stop the next headline.
infosec SIMPLIFIED 