The data breach landscape has shifted dramatically. What was once dominated by stolen password databases and SQL injection attacks has evolved into a world where cloud misconfigurations, stolen credentials without MFA, and supply chain compromises are the primary attack vectors. According to the Identity Theft Resource Center, 2025 saw a record 3,322 data compromises — a 79% increase over five years. The first half of 2026 has already surpassed all of 2025 in victim notices.
For CloudOps teams managing infrastructure across AWS, GCP, and Azure, these breaches aren’t abstract news stories. They are case studies in what happens when identity controls fail, when cloud storage is left without guardrails, or when vendor dependencies become single points of failure.
Here are the most consequential data breaches of recent years and what your CloudOps team can take away from each.
1. Snowflake Customer Breach Campaign (2024) — The Multi-Tenant Cloud Wake-Up Call
In mid-2024, a threat actor tracked as UNC5537 (affiliated with the Scattered Spider group) systematically compromised over 165 Snowflake customer environments, including Ticketmaster (560 million records), AT&T (call records of nearly all cellular customers), Santander Bank, and Advance Auto Parts.
The attack method was remarkably simple: the attackers used credentials stolen through infostealer malware to log into Snowflake accounts that did not have multi-factor authentication (MFA) enabled. No zero-day was exploited. No sophisticated malware was deployed. Just stolen passwords and no MFA.
In August 2026, Canadian citizen Connor Moucka pleaded guilty to hacking more than 165 companies and extorting several of them.
CloudOps Lesson: MFA is not optional — for any cloud service, SaaS platform, or data warehouse. Your team must enforce MFA across all cloud accounts, including third-party SaaS tools that host sensitive data. Implement IAM policies that mandate MFA at the identity provider level, and audit which service accounts or data platforms lack this control. If a vendor doesn’t support enforceable MFA, that’s a risk factor in your vendor assessment.
2. Change Healthcare Ransomware Attack (2024) — The $872M Single Point of Failure
On February 21, 2024, the ALPHV/BlackCat ransomware group attacked Change Healthcare, a subsidiary of UnitedHealth Group that processes approximately 40% of all U.S. healthcare claims. The attack took payment processing infrastructure offline for weeks, disrupting care delivery across hospitals, pharmacies, and physician practices nationwide.
Approximately 190 million people had their healthcare data exposed — making it the largest medical data breach in U.S. history. UnitedHealth Group reported over $872 million in breach-related costs. The attackers gained initial access through a Citrix remote access portal that lacked MFA.
CloudOps Lesson: This breach highlights the catastrophic risk of single points of failure in critical infrastructure. For CloudOps teams, the lesson is threefold: (1) ensure every remote access gateway has MFA enforced without exceptions, (2) implement network segmentation so that a compromised entry point cannot reach your entire infrastructure, and (3) build disaster recovery and business continuity plans that account for extended outages of critical third-party services. Review your cloud architecture for misconfigurations that create similar blast radius risks.
3. MOVEit Supply Chain Breach (2023) — SQL Injection at Scale
In May 2023, the Cl0p ransomware gang exploited a zero-day SQL injection vulnerability (CVE-2023-34362) in Progress Software’s MOVEit Transfer file transfer tool. The automated attack compromised over 2,700 organizations and exposed the personal data of approximately 93.3 million individuals in a matter of days.
Victims included Shell, British Airways, the U.S. Department of Energy, and dozens of government agencies. The attackers didn’t need to breach individual organizations — they targeted a shared infrastructure component that thousands of enterprises relied upon.
CloudOps Lesson: Supply chain risk is cloud risk. Your CloudOps team needs a complete inventory of all managed file transfer tools, third-party integrations, and shared infrastructure components. Implement automated vulnerability scanning for every externally-facing service. Establish a patching SLA for critical vulnerabilities (measured in hours, not days). Most importantly, apply the principle of least privilege to file transfer services — they should never have broader network or database access than strictly necessary.
4. Microsoft / Midnight Blizzard (2024) — Legacy OAuth Tokens as Attack Vectors
In January 2024, Microsoft disclosed that Russian state-sponsored group Midnight Blizzard (APT29/Cozy Bear) had accessed senior executive email accounts. The attackers used a password spray attack against a legacy test tenant account that lacked MFA, then leveraged a legacy OAuth application with elevated privileges to access the Microsoft corporate environment.
The attackers operated within Microsoft’s systems from November 2023 through January 2024 before detection. They accessed email accounts of senior leadership and legal teams, exfiltrating sensitive communications.
CloudOps Lesson: Legacy and test accounts are live attack surface. Every CloudOps team must maintain an inventory of all OAuth applications, service principals, and test tenants — and enforce the same security controls on them as production assets. Implement automated detection for privilege escalation patterns and anomalous access to sensitive resources. Regularly audit OAuth app permissions and remove those that are no longer needed. A CSPM solution can continuously monitor for these dormant-but-dangerous configurations.
5. National Public Data Breach (2024) — 2.9 Billion Records with Zero Encryption
In April 2024, a cybercriminal known as “USDoD” exfiltrated 4 terabytes of data from National Public Data, a Florida-based background check company. The dataset contained approximately 2.9 billion records including full names, Social Security numbers, addresses, and phone numbers — with no encryption protecting the data at rest.
The company subsequently filed for bankruptcy. Multiple class-action lawsuits were filed, and the breach became a defining example of what happens when a data aggregator lacks basic security controls.
CloudOps Lesson: Encryption at rest is not a luxury — it’s a baseline requirement. If your organization stores PII, encrypt it with customer-managed keys (CMKs) and enforce strict key access policies. Implement database activity monitoring to detect bulk data exfiltration patterns. Apply data classification policies to identify and protect sensitive data stores. Any S3 bucket, RDS instance, or data warehouse containing PII must have encryption enabled with auditable access controls.
6. LastPass Breach (2022–2023) — When a DevOps Engineer Becomes the Target
The LastPass breach unfolded in two stages. First, in August 2022, an attacker compromised a developer’s endpoint through a third-party software package, gaining access to source code and internal secrets. Then, in a second incident, they targeted a senior DevOps engineer’s personal computer, installed a keystroke logger, and used the captured credentials to access encrypted cloud storage backups.
The attacker operated within LastPass systems for over two months undetected. They ultimately exfiltrated encrypted customer vault backups, customer metadata, and API keys. In December 2025, the UK’s ICO concluded that LastPass had failed to implement sufficiently robust security measures.
CloudOps Lesson: This breach demonstrates why privileged access management for cloud infrastructure requires more than just strong passwords. Implement Just-In-Time (JIT) access for sensitive infrastructure so that standing privileges don’t persist. Enforce hardware security keys for high-privilege roles. Deploy endpoint detection on all machines with access to production secrets. Segment your backup infrastructure so that compromising one credential cannot grant access to complete vault backups.
7. Instructure/Canvas Breach (2026) — The Largest Education Data Breach
In April 2026, the extortion group ShinyHunters breached Canvas LMS, the learning management platform used by over 40% of U.S. colleges. They exfiltrated 3.65 terabytes of data from approximately 275 million users across 8,809 educational institutions worldwide.
Despite Instructure claiming containment on May 6, the attackers re-compromised systems on May 7, replacing the login page with a ransom demand. Instructure ultimately paid the ransom in exchange for proof of data destruction. This breach accounted for an estimated 58% of all H1 2026 victim notices.
CloudOps Lesson: “Contained” doesn’t mean “secured.” After any breach, complete environment rotation is critical — all credentials, API keys, session tokens, and access keys must be revoked and reissued. This incident also underscores the importance of immutable infrastructure: if your systems can be re-compromised within days of “containment,” your remediation didn’t address the root cause. Implement infrastructure-as-code with automated drift detection to ensure configuration changes are tracked and auditable.
8. CrowdStrike Global Outage (2024) — Not a Breach, But a Resilience Lesson
On July 19, 2024, CrowdStrike distributed a faulty Falcon sensor update that crashed approximately 8.5 million Windows systems worldwide. Airlines, hospitals, payment processors, and emergency services were disrupted. Estimated insurer payouts reached $1.5 billion.
This wasn’t a cyberattack — it was a reliability failure in a security tool’s update pipeline. Every affected system required manual, hands-on-keyboard recovery.
CloudOps Lesson: Your security tools are part of your attack surface and your availability risk. Implement canary deployments for agent updates — even for trusted security vendors. Ensure your disaster recovery plan accounts for scenarios where your security tooling itself becomes the outage vector. Maintain the ability to boot and operate critical systems even when your primary security agent is non-functional. This is a core tenet of operational resilience in cloud environments.
Common Patterns: What These Breaches Reveal
Across these incidents, the same root causes recur:
| Root Cause | Breaches Where It Appeared |
|---|---|
| Missing or unenforced MFA | Snowflake, Change Healthcare, Microsoft |
| Overly permissive IAM / legacy OAuth | Microsoft, LastPass, Snowflake |
| No encryption at rest | National Public Data |
| Supply chain / third-party risk | MOVEit, CrowdStrike, LastPass |
| Inadequate detection & response | LastPass, Microsoft, Canvas |
| Incomplete post-incident remediation | Canvas/Instructure |
How Cloudanix Helps Prevent These Scenarios
Cloudanix provides continuous cloud security posture management that directly addresses the root causes behind these breaches:
-
Identity & Access Governance — Detect accounts without MFA, overly permissive roles, unused credentials, and legacy service principals across AWS, GCP, and Azure. Enforce least-privilege access with automated recommendations.
-
Misconfiguration Detection — Continuously scan for unencrypted storage, publicly exposed databases, permissive security groups, and missing logging — the exact configurations that enabled breaches like National Public Data and Snowflake.
-
Compliance Frameworks — Map your cloud posture against NIST, CIS, GDPR, HIPAA, and SOC 2 benchmarks to maintain continuous compliance.
-
Just-In-Time Access — Eliminate standing privileges with JIT access controls that grant time-bound permissions only when needed.
-
Cloud Detection & Response — Detect anomalous API calls, bulk data access patterns, and privilege escalation attempts before they become breaches.
Sign up for a free trial and assess your cloud security posture against the exact attack patterns that enabled these breaches.
Further Reading
- How to Respond to a Data or Security Breach
- Top 15 Cloud Misconfigurations in 2026 and How to Fix Them
- What is CSPM? Cloud Security Posture Management Explained
- What is CNAPP? Cloud-Native Application Protection Platform
- Elevate Your Security with IAM Just-In-Time (JIT) Access
- Cloud Detection and Response (CDR) Explained
- Podcast: Cloud Data Breach Preparation & Incident Response
- Podcast: Ransomware in the AI Era — Incident Response
- PAM for Cloud Infrastructure: Why Traditional PAM Falls Short
- As a CIO, Do You Have a Plan If a Data Breach Occurs?
