Lessons from 50 major cyber security incidents, 2020–2025 — each mapped to the control failure that made it possible.
These breaches were not won by attackers. They were lost by defenders.
Between 2020 and 2025, fifty security incidents provide a clearer account of enterprise security failure than most threat intelligence reporting. Ransomware disrupted a clearinghouse that touches roughly one in three United States patient records. A supply-chain compromise was distributed to an estimated 18,000 organizations through a vendor's own signed software updates. A single defective update disabled 8.5 million Windows machines.
Assigning each incident to its primary control failure produces a finding most security programs are not built to reflect: the leading causes are limited in number and are not new. Two categories — unpatched, internet-facing software and missing or bypassed authentication — account for just over half of the fifty incidents, a pattern that holds across the period regardless of how the data is split or filtered. Novel attack techniques appear in this data set. They are rarely the deciding factor.
Change Healthcare's parent company reported approximately $3.09 billion in total cost for fiscal year 2024, against a reported ransom payment of $22 million — less than one percent of the total.
Operational disruption typically exceeded response cost where the affected platform supported an entire industry: CDK Global's outage is estimated to have cost automotive dealers $1.02 billion over three weeks, and Delta Air Lines attributed roughly $550 million in losses to the CrowdStrike outage. Litigation costs, which often materialize years later, continued to grow. Two companies did not survive their incidents — National Public Data's parent filed for Chapter 11 within months of its exposure and shut down that December, and 23andMe filed for Chapter 11 in March 2025 after the breach contributed to a collapse in its valuation.
Not all impact can be expressed in financial terms. A London hospital trust confirmed that one patient death was attributable in part to a delayed blood-test result, a consequence of ransomware at pathology provider Synnovis, an incident that also produced 170 documented cases of patient harm. Clinical staff at Ascension reverted to paper-based recordkeeping for several weeks.
Each incident was assigned a single primary root-cause category. The resulting distribution is consistent and reproducible, not an estimate.
Unpatched or exploitable internet-facing software was the primary cause of 14 of the 50 incidents. Missing or bypassed authentication was the primary cause of 12. This concentration holds when the eleven incidents with only a suspected or presumed cause are excluded from the analysis. None of the leading categories reflect a novel attack method; each would have been recognizable to a security program operating in 2015.
A closer review of the twelve authentication-related incidents indicates that the underlying issue was rarely a decision against multi-factor authentication — in most cases, the affected account or system was simply not known to be in use. Colonial Pipeline's point of entry was a legacy VPN account that had not been deprovisioned; Microsoft's Midnight Blizzard intrusion began on a dormant test tenant; Change Healthcare's exposed Citrix portal had arrived with a 2022 acquisition. Deploying multi-factor authentication was not the primary obstacle in these cases. Identifying the asset was.
Each category is defined by how access was obtained, illustrated with incidents from the data set, and paired with the control that would most directly have addressed it.
Affected systems were typically internet-facing infrastructure — VPN appliances, mail servers, file-transfer platforms — exploited within hours to days of public disclosure. This category includes MOVEit, the Exchange server compromises, Kaseya, and the Salt Typhoon and Volt Typhoon intrusions.
This category includes both the absence of multi-factor authentication on internet-facing systems and cases where authentication was circumvented through phishing or prompt fatigue. Affected organizations include Change Healthcare, Colonial Pipeline, Snowflake, Uber, and 23andMe.
A single compromised vendor can affect many downstream organizations at once. A trojanized SolarWinds update was installed by an estimated 18,000 organizations, though only a small subset were exploited further; Salesloft Drift's stolen OAuth tokens reached more than 700 companies without a login event.
This category includes data retained longer than necessary, stored without encryption, or shared with no attacker involved. Kaiser Permanente's third-party tracking code transmitted data from authenticated patient pages to advertising platforms, affecting 13.4 million members.
These incidents required limited technical capability but achieved a high rate of success. MGM Resorts was compromised through a phone call to its help desk; Caesars was reached via an outsourced IT support vendor, and Clorox through an outsourced help desk that reset credentials without verifying identity.
In each incident, a highly sensitive credential was handled without adequate safeguards — a signing key retained in a crash dump, a service credential stored in a personal browser profile. Affected organizations include Microsoft, Okta, LastPass, and Nvidia.
These incidents resulted from authorization and design flaws rather than authentication failures. Optus operated a customer-facing API requiring no authentication; Dell approved fraudulent reseller accounts with no rate limiting.
Only one incident — T-Mobile's repeated breaches, 2021 to 2023 — was assigned governance as its primary cause, but comparable failures recur throughout the record, including Uber's 2016 concealment of a breach.
Root cause explains how an incident occurred. A separate factor, present in more than fifteen of the fifty incidents, explains why the resulting impact was severe — and it was rarely a function of attacker sophistication.
This factor takes two general forms. The first is inadequate network segmentation: at Change Healthcare, a single compromised server was able to reach clearinghouse infrastructure that touches roughly one in three United States patient records. The second is market concentration, in which a single vendor's operations proved essential to an entire industry.
Share of U.S. patient records touched by the affected clearinghouse, which processes about 15 billion transactions a year.
Dealer locations across North America unable to operate normally during the outage.
Student records exposed through one stolen support credential; the vendor reports serving roughly 75% of the North American K-12 market.
Windows systems affected by one simultaneous update; no attacker was involved.
Market-wide U.S. Treasury repo fails the day after the attack, up from $25.5B a day earlier.
Confirmed, with a delayed blood-test result cited as a contributing factor.
Market structure is not within a security team's control. Identifying which vendors could disrupt an organization's own operations, and confirming that contingency plans have been tested rather than assumed, is a governance responsibility.
The data set is not static across the period. Five developments are visible in it, each with a distinct implication for planning.
The earlier part of the period is defined by attacks on code — the SolarWinds build pipeline, Log4j's library default. The later part is defined by attacks on the systems that establish identity: signing keys, session tokens, OAuth grants. By the end of the period, tokens and keys had become a primary target in their own right.
Comcast applied a patch for Citrix Bleed roughly thirteen days after disclosure and still paid a $117.5 million settlement, because the relevant sessions had already been taken. Effective remediation requires both patching and credential rotation.
Change Healthcare's disclosed $22 million payment and PowerSchool's $2.85 million did not prevent further use of the stolen data — PowerSchool's proof of deletion was later found to have been falsified. Where the objective is preventing disclosure, payment does not reliably achieve it.
MGM Resorts, Caesars Entertainment, and Clorox each experienced an incident in 2023 that began with social engineering of support staff rather than a technical exploit. MGM's entry point was a phone call to its help desk; Caesars was reached through an outsourced IT support vendor; Clorox's outsourced help desk reset credentials without verifying identity.
Colonial Pipeline produced the first mandatory pipeline security directives; SolarWinds contributed to new SEC disclosure rules; the FCC's consent decree required board-level oversight at T-Mobile; Uber's former security chief received a criminal sentence for concealing a breach. Disclosure is now a legal obligation rather than a communications decision.
Items 01, 02 and 04 through 08 are ranked by the number of incidents for which each was the primary root cause; together the first two account for 26 of the 50. Item 03 is cross-cutting: segmentation was rarely the way in, but it determined how far an incident spread.
A statement of regulatory or framework compliance does not answer the questions below — every organization in this data set maintained a compliance program.
Which vendors, if compromised or unavailable, would materially disrupt our operations — and when was the contingency plan for each last tested?
How many accounts are not protected by phishing-resistant multi-factor authentication, including service accounts and systems acquired through mergers?
What is our measured time from vulnerability disclosure to patching and credential rotation, and when did that last exceed 72 hours?
Can we produce a current inventory of third-party integrations and OAuth grants — and could a given vendor's access be revoked within a defined period?
If our most likely point of initial access were compromised, what would it reach — and can isolation be demonstrated rather than assumed?
What categories of data do we retain that we would be unable to adequately protect if targeted — and why are we still retaining them?
In this data set, the incidents with the most significant consequences for leadership were typically preceded by known, unaddressed conditions rather than by a lack of awareness. A regulator has alleged that Medibank was aware of serious deficiencies for at least eighteen months. T-Mobile's pattern of repeated breaches reflected unresolved issues rather than new ones. Rackspace deferred a patch as a deliberate operational decision. A board's role is to ensure that the cost of leaving a known condition unaddressed exceeds the cost of addressing it.
From Axiarete
Across these fifty incidents the condition was almost always knowable before it was exploited. Colonial Pipeline’s dormant VPN account. Change Healthcare’s inherited Citrix portal. Comcast’s patch, applied thirteen days after disclosure and still after the sessions had been taken. What separated the organizations that absorbed these events from the ones that did not was the distance between knowing and closing.
Axiarete Vulnerability Manager is built for that distance. AI agents discover what is genuinely exposed across the application estate, qualify each finding against reachability, exposure and the business process it sits under, then carry remediation through your existing pipelines to verified closure — continuously, rather than on a quarterly cycle.
It is where enterprise application security risk management is heading, and it is already remediating in Fortune 500 production.
See how it works