A 24-billion-record credential dump and a wave of session-hijacking attacks show why MFA and password policies alone can no longer be the last line of defense.
Cybernews researchers recently disclosed the takedown of an unsecured database containing 8.3 terabytes of data – 24 billion username-and-password pairs aggregated from 36 sources and traded through Telegram channels. Approximately 22.6 billion of those records came from compiled collections of historical breach data. The remaining fraction came from infostealer malware logs: credentials harvested directly from infected enterprise machines, often within hours of capture.
That fraction is the part that should concern every security leader whose organization handles regulated data. Not because 24 billion is an unprecedented number – credential aggregates of this scale are no longer unusual. Because the infostealer-derived records are active. They were captured from machines currently running in production environments, and the credentials they contain are likely still valid against the enterprise applications those machines access every day.
The rational response to this is not another password rotation campaign. It is rethinking the security architecture under the assumption that the authentication layer has already been defeated.
Why Password Controls Are Structurally Insufficient
The assumption underlying most authentication security programs is that passwords, supplemented by multi-factor authentication, provide adequate protection for enterprise applications. That assumption was reasonable when credential theft required targeted effort. It is not reasonable against an infostealer ecosystem that operates at scale, captures credentials from browser storage and password managers automatically, and delivers structured logs to buyers within hours of the original infection.
Modern infostealers – RedLine, Lumma, Vidar, and comparable families – do not just harvest username-and-password pairs. They extract browser session cookies issued after legitimate multi-factor authentication events. A stolen session cookie allows an attacker to authenticate as the victim user without knowing the password and without triggering the MFA challenge, because the original MFA was already completed. The session is valid. The user is, as far as the application is concerned, authenticated.
The FortiBleed campaign disclosed the same week makes this concrete. SecurityWeek reported that threat actors compiled 86,000 confirmed working credentials from FortiGate devices across 194 countries – credentials originally obtained through prior incidents involving CVE-2026-24858, CVE-2025-59718, and CVE-2025-59719. The FortiBleed campaign then used AI-assisted automation for target identification and password spraying to validate and weaponize that credential set against live devices. The speed at which a large credential pool can now be validated against live targets is a structural change in attacker capability that organizations calibrated to pre-AI threat models have not yet accounted for.
The Control Plane Is What Holds
When security architects think about defending against credential-based attacks, they typically focus on the authentication event itself – enforcing MFA, monitoring for failed login attempts, implementing risk-based authentication. Those controls are necessary. They are not sufficient.
The attacker who authenticates using a stolen credential is, by definition, past those controls. What they do next determines the impact. And what they do next, in almost every confirmed credential-based breach, is navigate to sensitive data.
File transfer portals, secure messaging platforms, document collaboration environments, and MFT systems are the destinations where sensitive data lives. They are also, historically, the applications where access controls have been weakest. Many were deployed years ago under a threat model that assumed the authentication layer would keep unauthorized users out. The access controls governing which data a user can reach, what they can do with it, and what gets logged were treated as secondary.
That architectural assumption is now the primary vulnerability. The Klue supply chain attack, disclosed the same week, illustrates the pattern at scale. Attackers used compromised OAuth tokens – not passwords, but the authentication artifacts that modern SaaS platforms use as the functional equivalent – to access the Salesforce environments of LastPass, HackerOne, Huntress, Jamf, OneTrust, Recorded Future, Snyk, Tanium, and others simultaneously. The authentication mechanism differed from credential stuffing, but the logical structure was identical: authenticated access followed by data access, limited only by whatever the compromised token was authorized to reach.
If those organizations had used a platform with a unified control plane – granular attribute-based access controls, DLP scanning, and immutable audit logging across every channel – the blast radius would have been bounded. The attacker would have authenticated, encountered policy-enforced constraints on what they could reach, and generated an alert. Instead, the organizations that used Klue’s Salesforce integration lost customer data – bounded only by what that integration was authorized to access.
The Architecture That Works Against This Threat
The security principle that resolves the credential-compromise-to-data-breach chain is straightforward: do not trust authentication. Apply access controls through the control plane for secure data exchange, independent of whether the authentication event was legitimate.
Attribute-based access control (ABAC) through the control plane means that every document, file, and message is governed by policy specifying who can access it, under what conditions, from what devices, and what actions they can take. A user whose credential has been compromised may authenticate successfully. If their behavior then deviates from policy – if they access data outside the scope of their role, if they attempt bulk downloads, if they connect from an unregistered device – the policy rejects the action and generates an alert. The authentication layer has failed; the control plane has not.
Immutable audit logging is the evidentiary component. Incident responders, regulators, and legal counsel all eventually ask the same question: what exactly did the compromised account access, and when? That question requires a specific, timestamped, searchable record – not a representation that access controls were configured correctly. Organizations that cannot produce that record face a compounded problem: not only the security incident itself, but the inability to scope it, contain it, or demonstrate compliance with breach notification requirements.
Behavioral anomaly detection on authenticated sessions is the detection layer. Monitoring for failed authentication attempts is necessary but insufficient – it detects the attack attempts that did not succeed. The succeeded attempts look like normal authenticated sessions until behavioral analysis identifies access patterns inconsistent with the user’s historical profile. This capability needs to sit within the control plane, where the data access events are happening, not only at the network perimeter.
The Practical Implication
The 24 billion record disclosure is a data point in a trend that has been developing for years. Credential aggregates at this scale are a feature of the current threat environment, not an anomaly within it. The infostealer ecosystem that supplies the most dangerous records in these collections is growing, and AI-assisted credential validation is making the conversion of stolen credentials into confirmed access faster and cheaper.
The response that scales is not more aggressive password rotation. It is a defense architecture designed for the assumption that some fraction of your workforce’s credentials are, at any given time, in an attacker’s hands. That architecture applies access controls and monitoring through the control plane for secure data exchange – independently of whether the authentication layer holds. The question every security leader should be able to answer today is: if an attacker authenticates to our data exchange platforms using a valid credential right now, what can they reach, what prevents exfiltration, and what record will exist for the incident response team?
If the answer to any of those three questions is “we are not sure,” that is where the work starts.
_____
About: Frank Balonis is chief information security officer and senior VP of operations and support at Kiteworks, with more than 20 years of experience in IT support and services. Since joining Kiteworks in 2003, Frank has overseen technical support, customer success, corporate IT, security and compliance, collaborating with product and engineering teams. He holds a Certified Information Systems Security Professional (CISSP) certification and served in the U.S. Navy. He can be reached at fbalonis@kiteworks.com.
