Not Exotic, Just Ordinary: Five Breaches and the Boring Failures Behind Them

Four of these five breaches didn't need a clever exploit. They needed a stolen password, a convincing phone call, an unpatched home PC, or a vendor's laptop.

Introduction

The purpose of this report is to review five recent organizational network security breach incidents in order to catalog the affected organization, data compromise, exploited vulnerability, potential preventative measures, and document a source reference. Additionally, the incidents will be reviewed to highlight similarities and differences between them, and to analyze the potential impact of proposed solutions and mitigation.

Incidents

Change Healthcare

MOVEit

MGM

LastPass

Okta

Comparative Analysis

Examining both the similarities and differences in each case can provide insight into how such incidents occur, and how effective responses and mitigation efforts were. Most incidents listed here could possibly have been prevented through more strenuous risk assessment and vulnerability analysis, with the exception of the MOVEit breach, which occurred through the use of a 0-day exploit. Most mitigation against 0-day exploits within current security methodology revolves around detection and not necessarily predictive efforts to hunt undiscovered exploits within an organization's network. Guarding against unknown exploits may simply come down to being prepared to detect them as quickly as possible, and having systems in place such as firewall rules that make data theft difficult for malicious actors.

Each of the four remaining incidents displays commonality in obvious failures at some level. When I first wrote this report, it was interesting to note that in some cases the exact exploit remained unknown. I speculated that Change Healthcare may have fallen to an undisclosed 0-day, as MOVEit did. That turned out to be wrong, and in a more sobering way: no zero-day was needed. Stolen credentials and a portal without MFA were enough.

Considering both Change Healthcare and MGM were victims of ransomware, only Change Healthcare is reported to have paid. MGM refused to pay and absorbed tens of millions in losses over more than ten days of downtime, while its competitor Caesars, hit by the same group, paid $15 million. The reasons behind those decisions may always be private, but it would be interesting to know the factors that play into whether or not an organization decides to pay a ransom. The ethical concerns surrounding ransomware payments are fascinating.

Two cases stand out among the rest, for different reasons. The Okta breach was unique in that it suffered a very standard third-party exposure, yet its impact stayed small by modern standards. Okta says its support engineers worked through a least-privilege tool that could not create or delete users, download customer databases, or reach source code, and its security team suspended the compromised account within about an hour of the alert. Particularly impressive is the statement issued by Okta's CSO, David Bradbury, detailing the attack and mitigation efforts while striking a tone between reassuring and apologetic. It's worth noting the timing, though. Okta contained the account in January, but the public heard about it in March, after the LAPSUS$ group posted screenshots. Bradbury himself wrote that he was "greatly disappointed by the long period of time" between notifying Sitel and getting the complete investigation report. Okta's transparency was good once it came, but it came late.

Okta's efforts contrast sharply with the LastPass breach noted in the data, which unfolded over several months as a pair of linked incidents snowballed into an embarrassing episode. In August 2022, attackers stole source code from LastPass's development environment. Each step became a steppingstone towards the goal of getting the keys to LastPass's cloud storage.

One of only four DevOps engineers with access to those keys ran a Plex media server at home, on a computer that also held corporate credentials. Plex later confirmed that the flaw used had been patched in May 2020, and that the engineer never updated. Attackers used it to install a keylogger and reached the vault of corporate keys, then copied customer vault backups. Those vaults were encrypted with each user's master password, so their safety came down to how strong each master password was. That protection was not absolute. By September 2023, researchers had linked thefts of more than $35 million in cryptocurrency from 150+ victims to cracked vaults, and the UK's data protection regulator later fined LastPass for failing to secure its systems, citing among other things senior staff using business accounts from personal devices. It is a unique case, and a reminder to both organizations and employees that passwords and encryption keys should never be stored on unprotected personal devices or home networks.

One final issue to address here is the prevalence of social engineering and spear-phishing campaigns. In the MGM attack, attackers reportedly picked out an employee on LinkedIn and impersonated them to the IT help desk by phone. This is an all-too-common occurrence. Such incidents were also factors in the famous 2020 Twitter account hacking attack, where Twitter said attackers used a phone spear-phishing attack against employees, and in Google's August 2025 breach, where attackers reached a Salesforce database. How can these attacks be prevented? Access controls and authentication have come a long way, with authenticator apps and phishing-resistant methods like passkeys. Can the problem organizations face by impersonation and social engineering via phone and email be solved? What if, for example, a help desk employee could push a text message to the phone of the named employee seeking assistance with a one-time code, to be read back over the phone? In any event, user education and social engineering resistance training can go a long way towards countering these types of attacks.

Conclusion

In most every case discussed here, it would seem that more robust vulnerability and risk assessment could have possibly prevented the attacks. Proactive defense must never rest. Processes to identify weaknesses in both the technical and human aspects of network security must be honed, implemented and ongoing, along with constant development of mitigation strategies and training.

The Takeaway

Line the five up and a pattern shows. Change Healthcare was a missing MFA prompt. MGM was a help desk that believed a caller. LastPass was an unpatched media server on an engineer's home PC. Okta was a vendor's laptop. Only MOVEit was a true software zero-day. The expensive part of each breach was something ordinary: an identity, a person, a process, or a patch nobody applied. Defense doesn't have to be exotic to be effective, but it does have to be boring and consistent, every day, everywhere.

Sources

• Kerner, S. (2024, March 8). The Change Healthcare attack: Explaining how it happened. TechTarget.
• Change Healthcare breached via Citrix portal with no MFA. TechTarget.
• Change Healthcare discloses USD 22M ransomware payment. IBM Think.
• CISA. (2023, June 7). #StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability.
• Progress Software's MOVEit meltdown: uncovering the fallout. Cybersecurity Dive.
• Schrader, D. (2025, February 14). An Overview of the MGM Cyber Attack. Netwrix.
• MGM Resorts ransomware attack led to $100 million loss, data theft. BleepingComputer.
• What everyone got wrong about the MGM hack. 1Password.
• MGM, Caesars Cyberattack Responses Required Brutal Choices. Dark Reading.
• Kost, E. (2025, January 5). The LastPass Data Breach (Event Timeline And Key Lessons). UpGuard.
• LastPass engineer's failure to update Plex software led to massive data breach. The Hacker News.
• LastPass 2022 data breach. Wikipedia.
• Bradbury, D. (2022, March 24). Okta's Investigation of the January 2022 Compromise. Okta.
• Twitter. (2020, July 30). An update on our security incident.
• Google discloses data breach via Salesforce hack. SecurityWeek.