A Password Nobody Remembered Just Took Down 200 Companies — Including the Ones That Sell Security.

Case Study Supply Chain

July 2026  ·  7 min read

In 2022, a software company issued a single credential for a small pilot project. The pilot ended. The credential was never turned off. Four years later, attackers found it, walked in, and used it to steal data from roughly 200 of the company's customers — including several of the most respected cybersecurity firms in the world. No malware. No exploit. Just a login that everyone forgot existed.

---

Somewhere in a company's systems in 2022, someone created a credential. It was for a limited pilot — a trial integration, a proof of concept, the kind of small project that happens constantly at software companies. The pilot did what pilots do: it ran for a while, produced its result, and ended. The integration was abandoned. Everyone moved on.

The credential was never revoked.

For four years it sat there — valid, active, forgotten. Not monitored, because nobody remembered it existed. Not rotated, because it wasn't on anyone's list. Not disabled, because the project it belonged to was over and out of mind. It was a working key to the building, left under a doormat that everyone had stopped looking at.

In June 2026, attackers found it. And what happened next is one of the most instructive breaches of the year for any business that relies on outside vendors, cloud tools, or third-party integrations — which is to say, every business.

~200

companies had data stolen because of one forgotten credential — including several major cybersecurity firms

The company that owned the credential was a market intelligence platform used by hundreds of businesses. Attackers used the dead credential to get in, then harvested the digital keys that connected the platform to its customers' systems — and used those keys to reach into roughly 200 customer environments and steal their data. The victims included some of the best-known names in cybersecurity. The irony was not lost on anyone.

Here's the part that matters for your business: the initial breach didn't require any sophistication at all. No zero-day exploit. No advanced malware. No nation-state tooling. The attackers logged in with a credential that should have been switched off years earlier. The sophistication came afterward — but the front door was opened with a key that was left lying around.

How one dead credential became 200 breaches

The mechanics of this attack are worth understanding because they illustrate exactly how modern supply-chain breaches cascade. Here's the sequence:

Anatomy of the dead-credential breach

2022A credential is issued to a third party for a limited pilot integration. The pilot ends. The credential is never revoked.

2022–26Four years pass. The credential remains valid and unmonitored. Nobody remembers it exists.

Jun 11Attackers find and use the dead credential to access the platform's integration infrastructure.

Jun 12They deploy code to harvest OAuth tokens — the digital keys that connect the platform to each customer's cloud systems.

Jun 12Using those stolen keys, attackers impersonate the platform and reach directly into ~200 customers' CRM and cloud environments.

Jun 12+Automated scripts bulk-export customer business data — contacts, sales records, pricing, opportunity notes — for extortion.

AfterA second criminal group obtains the same stolen data, and the extortion starts over. The breach doesn't end when the first attacker leaves.

The pivot point — the thing that turned one compromised vendor into 200 breached companies — was the OAuth token. An OAuth token is a digital key that lets one app access your data on another service without needing your password. When you click "Connect to Google" or "Sign in with Microsoft" to link a tool to your systems, you're issuing an OAuth token. It stays valid until someone revokes it. Most businesses have dozens of these connections and have never audited a single one.

This is the detail every SMB owner needs to sit with: the attackers didn't need your password, and MFA didn't stop them. OAuth tokens bypass both. Once the attackers had the tokens connecting the vendor to its customers, they could walk straight into those customers' systems as if they were the trusted vendor. Your MFA doesn't challenge a connection you already authorized. This is why "we have MFA" is not a complete answer to third-party risk.

48% of all breaches now involve a third party — up 60% year over year. Your vendors' security is now your security. Verizon DBIR 2026

4 years the dead credential sat active and forgotten before attackers found it — a window that existed only because nobody was tracking it Vendor disclosure / breach reporting 2026

+2,000% rise in OAuth-based attacks against SMB environments — the exact technique used to pivot into 200 companies here Guardz State of MSP Threat Report 2026

Why this is a small business story, not a big company story

It's tempting to read this as a story about big software companies and their big customers. It isn't. It's the most universal breach in this entire series, because the root cause — a forgotten credential and unaudited third-party access — exists in essentially every small business, usually in greater quantities than in large ones.

Think about your own systems. The contractor you gave access to for a project in 2023 — is their login still active? The accounting tool you trialed and abandoned — did you revoke its connection to your bank feed? The former employee's account — fully deactivated, or just "we changed the password"? The marketing app someone connected to your Google Workspace two years ago and stopped using — is that OAuth token still live? The vendor who needed temporary access to your systems and never got switched off?

Every one of those is a dead credential waiting to be found. Small businesses accumulate them faster than large ones because there's rarely anyone whose job is to track them. Software gets trialed and abandoned. Contractors come and go. Employees leave. Integrations get connected and forgotten. Each one is a key left under a doormat — and attackers are systematically checking under every doormat, because it's far easier than breaking a window.

The four things to do this week

1

Audit your OAuth connections — the keys you forgot you handed out

30 minutes · Free

Every "Sign in with Google/Microsoft" connection and every app you linked to your email, storage, or CRM is an OAuth token that stays live until revoked. Most businesses have dozens. The abandoned ones are pure risk with zero benefit.

Do this nowGoogle Workspace: admin.google.com → Security → API Controls → App Access Control → review third-party apps. Microsoft 365: Entra admin center → Enterprise Applications. Revoke anything you don't actively use or recognize. This is the single most direct defense against the exact attack described here.

2

Build a credential offboarding habit — for tools and contractors, not just employees

Policy · Free

Most businesses have an offboarding process for departing employees. Almost none have one for abandoned tools, ended contracts, or completed projects. The dead credential in this breach existed because a pilot ended and nobody had a step that said "revoke the access we created for it."

Do this nowAdd one rule: whenever a tool is abandoned, a contract ends, or a project wraps, revoking its access is part of closing it out. Keep a simple running list of every vendor, tool, and contractor with access to your systems, and review it quarterly.

3

Ask your critical vendors one question

Vendor risk · Free

48% of breaches now come through a third party. The vendors holding your data are part of your attack surface, and you're allowed to ask them about it. The businesses breached here were victims of their vendor's forgotten credential — a risk they could have asked about.

Do this nowAsk your most critical vendors: "How do you manage and rotate credentials and access tokens, and how quickly do you revoke access that's no longer needed?" A vendor who answers clearly is managing the risk. A vendor who can't is telling you something important.

4

Remember that MFA doesn't cover authorized connections

Awareness · Critical

The uncomfortable lesson of this breach: MFA protects your login, but it doesn't protect the connections you've already authorized. An OAuth token is a standing permission. Once granted, it doesn't get re-challenged by MFA. That's why token audits matter as much as strong authentication.

Do this nowTreat your authorized-app list as a security surface equal to your password policy. Review it on the same schedule. The connections you've granted are as powerful as the passwords you protect — and far more likely to be forgotten.

The Veriti Spottr CyberScore's Exposure and Security Posture components are built around exactly this class of risk — surfacing external exposure and assessing the access-hygiene and vendor-management practices that determine whether a forgotten credential becomes a 200-company breach. The dead credential that started this incident was invisible because nobody was looking for it. Continuous visibility is how you find the key under your own doormat before someone else does.

The one sentence that summarizes the whole breach

Roughly 200 companies — including firms whose entire business is protecting other companies from exactly this — had their data stolen because a login created for a small project in 2022 was never switched off. Not a sophisticated attack. Not an unstoppable adversary. A forgotten key.

The attackers in this story didn't do anything most SMBs would consider advanced to get in. They found something that was left on. The lesson isn't that you need better technology. It's that the access you've already granted — and forgotten — is very likely your largest unguarded risk. It costs nothing to go turn off the keys you're no longer using. It costs a great deal to explain to your customers why you didn't.

📚 Credential Security Series — Read the full series

Part 1 → Your Password Policy Isn't Protecting You. Your Employees' Habits Are. Part 2 → Your Credentials Are Already For Sale. Here's How to Find Out in 60 Seconds. Part 3 → You Turned MFA On. Attackers Already Have Three Ways Around It. Part 4 → What Attackers Do With Your Data in the First 60 Minutes Part 5 → The 30-Minute Security Audit Every SMB Owner Should Do This Week Part 6 → The First 24 Hours After You Discover a Breach

Find the forgotten keys before someone else does. Veriti Spottr's beta is free.

Get your CyberScore →

VS

Veriti Spottr Team AI-powered cyber risk clarity for SMBs  ·  veritispottr.com