A Password Nobody Remembered Just Took Down 200 Companies — Including the Ones That Sell Security.
Case Study Supply Chain July 2026 · 7 min read In 2022, a software company issued a single credential for a small pilot project. The pilot ended. The credential was never turned off. Four years later, attackers found it, walked in, and used it to steal data from roughly 200 of the company's customers — including several of the most respected cybersecurity firms in the world. No malware. No exploit. Just a login that everyone forgot existed. Somewhere in a company's systems in 2022, someone created a credential. It was for a limited pilot — a trial integration, a proof of concept, the kind of small project that happens constantly at software companies. The pilot did what pilots do: it ran for a while, produced its result, and ended. The integration was abandoned. Everyone moved on. The credential was never revoked. For four years it sat there — valid, active, forgotten. Not monitored, because nobody remembered it ...