MyRecon OSINTHow Data Breaches Actually Happen: The Seven Ways In
Read enough breach reports and the variety disappears. Different companies, different decades, different amounts of money — and almost always one of seven ways in. This is what each of them looks like, which well-documented case proves it, and what actually closes it.
The reason this is worth knowing is not curiosity. It is that news coverage almost never distinguishes between the route in and the damage done, so every breach reads as an unforeseeable catastrophe. They are not unforeseeable. They are repetitive, and the repetition is the useful part.
1. Stolen credentials
The most common route by a wide margin. Somebody's username and password — an employee, a contractor, a service account — end up in an attacker's hands, and they log in. No exploit, no malware on the way in, nothing that looks like an attack in any log.
The credentials come from phishing, from malware on a personal device, or from an earlier breach where the person reused the password. Once inside, the attacker moves through the network using access the account legitimately has.
The cases: eBay in 2014 lost 145 million records to a handful of compromised employee accounts. JPMorgan Chase lost data on 83 million households the same year, because one server in a large estate had been missed when two-factor authentication was rolled out. The Snowflake campaign of 2024 hit dozens of major companies at once using credentials stolen by malware, against cloud tenants where multi-factor authentication was not enforced.
What closes it: phishing-resistant multi-factor authentication, on every account, with no exceptions — and the exceptions are where the breach happens. A password on its own should not open anything.
2. The supplier
The attacker does not attack you. They attack a company you depend on, and arrive through a connection you set up deliberately and trust by design.
This has become the dominant pattern in large breaches because the incentive is obvious: compromise one supplier and you reach all of its customers. The victim organisation may have excellent security and no bearing on the outcome whatsoever.
The cases: Target in 2013, through a refrigeration contractor. Home Depot in 2014, the same route one year later, for 56 million cards. MOVEit in 2023, where one flaw in file transfer software reached more than 2,700 organisations and 90 million people, most of whom had never heard of the product.
What closes it: knowing which suppliers can reach your systems and what they can reach, time-limiting that access, and segmenting it. Also, less obviously: knowing which software your suppliers depend on, because that is where the failure often actually sits.
3. Unpatched internet-facing software
Something reachable from the public internet has a known flaw, a fix exists, and it has not been applied. Attackers scan for these continuously and automatically, and the window between a patch being published and mass exploitation beginning is now measured in days.
The uncomfortable detail in most of these cases is that the organisation knew. The patch was on a list. The system was on an inventory, or should have been.
The cases: Equifax, where the fix had been available for two months and an expired certificate on the monitoring appliance meant nobody saw 76 days of data leaving. TalkTalk in 2015, through three webpages inherited in an acquisition six years earlier that nobody had looked at since. Accellion in 2021, against a twenty-year-old product already scheduled for retirement.
What closes it: knowing everything you have on the public internet — which is usually more than the official list — and patching internet-facing systems on a much shorter clock than everything else.
4. Social engineering a person, not a system
Somebody phones the IT help desk, sounds like an employee, and asks for a password reset. Or emails an accounts payable clerk with a plausible invoice. The technical controls all function correctly; a human being was persuaded.
This route has grown sharply because the others have got harder. It is also the cheapest: research on a professional network, a phone call, and a conversation.
The cases: MGM Resorts in 2023 — a ten-minute call to the help desk took a $14 billion company's Las Vegas operations offline for ten days. The 0ktapus campaign in 2022 phished employees at more than 130 companies with one text message template. Uber has featured in more than one variation of this.
What closes it: making the account recovery process itself resistant — video verification, out-of-band manager approval, a mandatory delay on re-enrolling a second factor. Awareness training helps at the margin; changing the process is what works.
5. The insider
Somebody with legitimate access uses it for a purpose it was not given for. There is no intrusion to detect and no control to defeat, because every action is one the person was authorised to take.
Insider cases divide into the malicious — a grievance, a payment, a plan — and the far more numerous accidental: a file emailed to the wrong address, a database copied to a personal drive for convenience.
The cases: Morrisons in 2014, where a senior internal auditor published the payroll file of nearly 100,000 colleagues and the resulting litigation ran to the UK Supreme Court. Capital One in 2019 sits close to this line — a former employee of the cloud provider, using knowledge from the inside.
What closes it: monitoring bulk data access by the people most entitled to it. Insiders do not defeat controls; they use them, so detection has to look for unusual volume and timing by authorised users rather than for unauthorised ones.
6. Misconfiguration
Nobody attacked anything. A database, a storage bucket or a server was placed on the internet without a password, and somebody found it — often a researcher, sometimes not, and there is rarely any way to know who looked first.
This is the most preventable category and one of the most common, because cloud platforms make it a single setting and the default has not always been the safe one.
The cases: the Aadhaar-linked exposures, where the underlying database was not breached but systems connected to it leaked repeatedly. The National Public Data affair, whose sister site was separately found publishing a plaintext password file. The 622-million-record enrichment exposure in the archive, which was an unsecured search server belonging not even to the company whose data it held.
What closes it: scanning your own external footprint the way an attacker would, continuously, and treating "is anything of ours answering the internet without authentication" as a question with a monitored answer rather than an assumed one.
7. Scraping and aggregation
Nothing private is taken. Information already visible to anyone is collected at scale, compiled, and sold — and the result is a capability that did not exist when the same data was spread across a million pages.
Whether this counts as a breach is genuinely contested. Platforms say no, because no control failed. The people in the resulting file generally disagree, and regulators have increasingly sided with them.
The cases: the 2021 Facebook scrape of 533 million profiles. Clearview AI, which turned billions of public photographs into a face search engine and collected fines across four continents. Cambridge Analytica, where a documented platform feature working exactly as designed delivered data on 87 million people.
What closes it: from the platform side, rate limits and not building features that let one user hand over data about another. From your side: assuming anything public is permanently collected, and being deliberate about which of your details are public at all.
The route in is not the damage. These seven describe how attackers get a foothold. What happens next — how far they move, how long they stay, how much they take — depends on entirely different controls: segmentation, monitoring, least privilege and encryption. A company can be breached through any of these routes and lose almost nothing, and several have. The route determines whether you get in. The interior determines what it costs.
What this means if you are not defending a company
Five of the seven routes are invisible to you as a customer. You cannot patch someone else's server, vet their suppliers or train their help desk. What you can do is limit what any one breach costs you.
- Unique passwords everywhere. This alone converts most breaches from a compromise into a notification letter, because credential stuffing is what turns one company's failure into your problem.
- Phishing-resistant two-factor authentication on email first. Email resets everything else, so it is the account whose compromise cascades.
- Assume the unchangeable fields are already out. Date of birth, address, national identifiers. Treat them as public knowledge rather than as answers to a security question.
- Watch which addresses you are exposed under. Old and forgotten email addresses are the highest-risk ones, because nobody is monitoring them and they are often the recovery address on accounts still in use.
Check whether your own address appears in a known breach with the MyRecon email tool, or read the full write-ups in the case files — every one is sourced from regulatory findings, court filings and company disclosures.
Read the case files → The live breach archive →