What went wrong in eight public breaches,
from the official record.

Eight incidents across seven years, regulators in two countries and very different attackers. The failures underneath them are few and repeat.

Credentials and authentication

Uber's attackers found a cloud key in code and reached the repository with reused passwords and no MFA. Colonial's attacker logged into a VPN with a username and password because the profile asked for nothing more. CircleCI's attacker skipped authentication entirely by stealing a session that had already passed it. CISA's SolarWinds advisory lists password spraying and poorly secured administrative credentials as further ways in. MFA everywhere, short sessions, no secrets in code, and short-lived credentials address most of this.

Access that should not have existed

Colonial's VPN profile was not meant to be in use. Equifax's attackers reached 48 unrelated databases because nothing separated them, and found plain-text credentials for more. The OCC found weak network security controls at Capital One. Access reviews, least privilege and segmentation are dull controls; these cases are what their absence looks like.

Patching and knowing what you run

Equifax had a patch policy and a 48-hour deadline. The notice went to an out-of-date list and the scan was not configured to cover every asset. MOVEit was a zero-day, so there was nothing to patch at first, and organisations that did not know where they ran it lost time. An accurate inventory is the control under both.

Third parties and the supply chain

SolarWinds customers installed legitimate updates that carried malicious code from a compromised build system. MOVEit victims were breached through a vendor's product. CircleCI customers lost secrets held by their CI provider. A supplier register that records what each vendor touches is where response starts.

Exposure nobody owned

The OAIC's first lesson from Optus is clear ownership of internet-facing domains, and its second is authorisation on every request for personal data. Capital One's data was reachable from outside because of a configuration gap. What faces the internet needs an owner, a test and a log.

Detection and disclosure

Equifax's inspection tool was blind for ten months because a certificate had expired. Capital One and CircleCI learned of their breaches from outsiders. Uber paid the attackers and told no one for a year, and its largest settlement was about that delay. Monitoring that works and an incident process with clear notification duties are the controls; the regulatory outcomes in these cases show what their absence costs.

• Official sources only. Every figure links to a regulator, government body, court filing or the company's own disclosure. News coverage is not used as a source of fact.
• No speculation. Root causes are described as the sources describe them. Where a source could not be read, the detail is left out and the page says so.
• No hindsight claims. We do not say any tool would have prevented these incidents. Each page names the control, its SOC 2 and ISO 27001:2022 references, and how TryTrustable checks it.
• Open matters stay open. Where proceedings have not concluded, the pages say they are allegations.

Related: SOC 2 guide · SOC 2 requirements · compliance as code · incident management · Research