Date

February 2024

Impact

190 million Americans affected; $872M+ in damages; $22M ransom paid; nationwide healthcare disruption for weeks.

Root Cause

Attackers used stolen credentials to access a Citrix remote access portal that lacked MFA. The portal was a legacy system acquired through M&A and never fully integrated into UnitedHealth’s security controls. Attackers moved laterally for 9 days before deploying ransomware.

IGA Relevance

Missing MFA on a legacy remote access system, failure to enforce least-privilege access, poor credential lifecycle management, no access reviews on acquired infrastructure.

Opal Prevention

Opal’s automated access reviews and continuous governance would flag legacy systems lacking MFA. Just-in-time access provisioning would prevent standing credentials on sensitive portals. Post-acquisition access discovery would surface unmanaged entry points.

Date

April–June 2024

Impact

~165 organizations compromised; AT&T lost call metadata for 109M customers and paid $370K ransom; Ticketmaster lost 590M records; Santander lost 30M customer files.

Root Cause

Threat group UNC5537 used credentials stolen via infostealer malware (some dating to 2020) to log into Snowflake customer instances. None of the breached accounts had MFA enabled. Credentials had never been rotated.

IGA Relevance

Stale, unrotated credentials on a critical SaaS platform with no MFA enforcement. Over 80% of compromised accounts had prior credential exposure. No automated deprovisioning of unused accounts.

Opal Prevention

Opal’s continuous access monitoring and credential lifecycle management would detect stale, high-risk accounts with missing MFA. Automated access reviews would revoke dormant Snowflake credentials. Policy-as-code enforcement could require MFA for all SaaS data platforms.

Date

November 2023 – January 2024

Impact

Russian state actor accessed senior leadership and cybersecurity team email accounts; source code and internal documents exfiltrated; ongoing unauthorized access persisted for months.

Root Cause

Attackers password-sprayed a legacy, non-production test tenant account that lacked MFA. That account had access to a legacy OAuth application with elevated permissions to Microsoft’s corporate environment. Attackers created malicious OAuth apps and granted themselves full mailbox access.

IGA Relevance

Orphaned test account with no MFA, over-privileged legacy OAuth application, no access review of non-production environments, failure to remove dormant accounts and excessive permissions.

Opal Prevention

Opal’s automated access discovery would surface orphaned test accounts and over-privileged non-human identities. Time-bounded access policies would prevent standing elevated permissions on legacy apps. Continuous governance would flag OAuth apps with excessive scopes.

Date

September 2023

Impact

$100M+ financial loss; 10 days of operational outage across Las Vegas properties; customer PII including SSNs and passports exposed; ongoing lawsuits and regulatory investigations.

Root Cause

Scattered Spider used LinkedIn reconnaissance to impersonate an MGM employee, then called the IT help desk to socially engineer a password reset and MFA re-enrollment. Once inside, attackers moved laterally through MGM’s Okta environment and deployed ALPHV ransomware.

IGA Relevance

Help desk lacked identity verification beyond knowledge-based questions. Password reset process required only basic employee information (name, employee ID, DOB). Once credentials were reset, no secondary approval or anomaly detection triggered.

Opal Prevention

Opal’s access request workflows with multi-party approval would prevent unverified help desk resets for privileged accounts. Identity-aware access policies could enforce step-up verification for sensitive resets. Automated anomaly detection on privilege escalation would flag suspicious activity.

Date

August 2023

Impact

Customer loyalty database with SSNs and driver’s licenses exfiltrated; $15M ransom paid; 41,397+ confirmed victims in Maine alone.

Root Cause

Scattered Spider launched a social engineering attack against Caesars’ outsourced IT support vendor. Attackers impersonated employees to trick help desk into providing login credentials, then used those credentials to access the loyalty database.

IGA Relevance

Third-party vendor had excessive access to production customer data. No identity verification beyond knowledge-based authentication at the help desk. Lack of access segmentation between IT support vendor and sensitive customer databases.

Opal Prevention

Opal’s third-party access governance would enforce least-privilege for outsourced vendors with time-bounded access. Access request workflows with approval chains would prevent social engineering at the help desk. Granular RBAC would segment support vendor access from customer PII.

Date

September–October 2023

Impact

Initially reported as 134 customers affected; later revised to all customer support system users (18,000+). Session tokens stolen for 1Password, Cloudflare, and BeyondTrust.

Root Cause

An Okta employee saved service account credentials to a personal Google account. Those credentials were compromised, giving attackers access to Okta’s customer support system. The service account had excessive permissions and bypassed MFA. Attackers stole HAR files containing session tokens.

IGA Relevance

Service account with excessive privileges and no MFA. Credentials stored on a personal device. No separation between personal and corporate account access on work devices. 14-day detection gap.

Opal Prevention

Opal’s non-human identity governance would enforce least-privilege and credential rotation for service accounts. Automated access reviews would flag service accounts bypassing MFA. Just-in-time access could replace standing service account credentials with ephemeral tokens.

Date

December 2024 – May 2025

Impact

~70,000 customer records exposed including government IDs and SSNs; $180–$400M estimated costs; $20M ransom demand (refused).

Root Cause

Cybercriminals bribed overseas customer support contractors at TaskUS in India (up to $2,500 per person) to copy customer data using their legitimate support tool access. One contractor reportedly photographed up to 200 customer records per day.

IGA Relevance

Third-party contractors had broad access to sensitive customer PII through support tools. No granular controls on what data support agents could view. Insufficient insider threat monitoring. Access scope was too wide for the job function.

Opal Prevention

Opal’s fine-grained access controls would restrict support agents to only the data fields required for their specific tasks. Behavioral monitoring and access analytics would detect anomalous data access patterns (200 records/day). Third-party access governance would enforce strict, auditable access policies for outsourced teams.

Date

August 2024 (disclosed)

Impact

272+ million SSNs potentially compromised; company filed for bankruptcy; numerous class-action lawsuits.

Root Cause

A publicly accessible file on an NPD sister site contained plaintext usernames and passwords, including admin credentials. No sophisticated hacking required—the data was essentially left unprotected online.

IGA Relevance

Admin credentials stored in plaintext and publicly accessible. No access controls on sensitive credential stores. Complete failure of credential management and access governance.

Opal Prevention

Opal’s secrets management and credential governance would prevent plaintext credential storage. Automated access audits would detect publicly exposed credential files. Continuous compliance monitoring would flag violations of basic access hygiene.

Date

December 2024

Impact

Chinese state-sponsored hackers accessed 3,000+ unclassified files including documents from the Secretary, Deputy Secretary, and CFIUS/OFAC offices.

Root Cause

Attackers compromised a third-party vendor (BeyondTrust) and used a stolen API key for a cloud-based remote support service to access Treasury workstations. The vendor’s compromised access provided a pathway into highly sensitive government systems.

IGA Relevance

Third-party vendor had broad access to sensitive government endpoints via API keys. Insufficient monitoring of vendor access patterns. No just-in-time access controls on third-party remote support.

Opal Prevention

Opal’s third-party access governance with time-bounded, just-in-time provisioning would limit vendor access windows. API key lifecycle management would enforce rotation and scope limitations. Continuous monitoring would detect anomalous access patterns from vendor service accounts.

Date

October 2024 – January 2025

Impact

25.9+ million individuals affected (including 15.4M Texas residents, 10.5M Oregon residents); 8+ TB of data stolen including SSNs and medical information.

Root Cause

Ransomware attackers accessed Conduent’s systems for nearly three months. As a business process outsourcer serving government agencies and large enterprises, Conduent’s compromised access exposed downstream customer data across multiple organizations.

IGA Relevance

Extended dwell time (nearly 3 months) suggests lack of access monitoring. Business process outsourcer had broad access to sensitive data across many client organizations. Insufficient network segmentation and access controls.

Opal Prevention

Opal’s continuous access monitoring and anomaly detection would shorten dwell time. Least-privilege enforcement across BPO relationships would limit blast radius. Automated access reviews would ensure outsourcer access is scoped appropriately per client engagement.