100 Million Records Leaked. The Door Was Unlocked.

# 100 Million Records Leaked. The Door Was Unlocked. A Canadian national just pleaded guilty to breaching 165 corporate accounts. That's the page at 3am. No zero-day. No complex chain of exploits. Just a man named Connor Riley Moucka and a set of stolen credentials. The numbers are stark. North of 100 million records exposed. One hundred and sixty-five victims. This wasn't a surgical strike; it was a harvest. The threat actor, UNC5537, didn't need to pick the lock because the keys were lying on the mat. The postmortem is simple. Attackers used infostealers (malware that scrapes browsers for saved passwords and session tokens) to grab credentials from employees' personal or compromised devices. Once they had the usernames and passwords for Snowflake accounts, they just logged in. They didn't have to fight through a firewall. They didn't need to bypass an EDR. They just provided a valid password. The victims' statements follow the standard corporate script. They use words like "sophisticated" and "targeted." They talk about "unauthorized access" as if it were a ghost in the machine. What they avoid saying is that these accounts lacked multi-factor authentication (MFA). If MFA had been enforced on every single account, this entire campaign would have stalled at the login screen. Instead, companies treated service accounts or legacy logins as "low risk" or "internal." They assumed the cloud provider's perimeter was enough. It wasn't. Getting hit is common. Handling it this badly is a choice. The failure here isn't technical; it's managerial. The response to these breaches has been sluggish and reactive. We're seeing cases where the dwell time (the gap between the first login and the detection of exfiltration) was measured in months. In a cloud environment, where data can be moved at gigabit speeds, a few hours is too long. A few months is catastrophic. The cost isn't just the immediate forensic bill or the legal fees. It's the permanent devaluation of the data. Once 100 million records hit the dark web, they don't go back. They become the fuel for every phishing campaign and identity theft attempt for the next decade. Then there is the second-order effect: the insurance fallout. Cyber insurers are no longer interested in "best effort" security. We're moving toward a reality where failing to enforce MFA on service accounts will be viewed as gross negligence. I expect we'll see payouts denied and premiums spike for any firm that can't produce an audit log showing 100% MFA coverage across all cloud identities. The insurers are the ones who will actually force the change, not the CSOs. This rhymes with the Target breach of 2013. Back then, it was a third-party HVAC vendor with a weak password that gave attackers a foothold in the network. The parallel is the reliance on a trusted entry point that isn't actually secured. Where the parallel breaks down is scale. In 2013, you had to move laterally through a physical network to find the credit card data. In 2026, if you have the right cloud credentials, you are already at the vault. The distance between "entry" and "exfiltration" has shrunk to zero. Some will argue that infostealers are an "uncontrollable risk", that you can't stop a user from installing a malicious browser extension on their home laptop. That's a lazy argument. You don't stop the infostealer; you stop the credential from being useful. An MFA token tied to a physical hardware key makes a stolen password worthless. The fact that UNC5537 was able to hit 165 different organizations proves that this is a systemic failure of identity hygiene, not an inevitable result of malware. The cost of this breach will be measured in the billions across the entire victim set. Between regulatory fines from South Korea's Lotte Card-style restrictions and the GDPR payouts, the financial bleed is just starting. We've spent five years talking about "Zero Trust." We bought the tools. We updated the slide decks. But Zero Trust isn't a product you buy; it's a state of paranoia. It means assuming the password has already been stolen and requiring something else to prove identity. If you're still running service accounts with static passwords, you aren't practicing security. You're just waiting for your turn in a guilty plea announcement. I want to know how many other "cloud-native" firms have an audit log they're afraid to look at. Specifically, I'm looking for the number of legacy API keys and service accounts that haven't been rotated since 2024. That is where the next 100 million records are sitting.