Every recent breach has the same shape.

Customer names, emails, phone numbers, addresses, and partial payment data exfiltrated through a third-party Snowflake instance.

Vendor stored extensive PII in a queryable cleartext warehouse. Credential compromise on the warehouse yielded everything.

Call and text metadata — who called whom, when, for how long — for nearly every AT&T mobile customer over a six-month window, exfiltrated via a third-party Snowflake workspace.

Vendor accumulated detailed communication metadata in a warehouse. Credentials to the warehouse were the only barrier; once compromised, the metadata was cleartext.

Health insurance records, medical claims, billing information, and personal identifiers exfiltrated by ALPHV/BlackCat ransomware.

Vendor stored sensitive medical records server-readable on infrastructure protected by traditional credentials. Ransomware operators reached the cleartext.

Cl0p ransomware exploited a zero-day in MOVEit Transfer to exfiltrate files in transit through the managed-file-transfer service.

Files flowed through a vendor service that decrypted them in transit for processing. The decryption point was the breach point.

Credential-stuffing attackers logged into individual accounts and, via the 'DNA Relatives' feature, pulled genetic profile data on millions of users they were never authenticated as.

One vendor-side feature (cross-user matching) meant access to one account exposed data from many.

Attackers exfiltrated backups of customer vaults. Vault contents were encrypted, but URL fields were stored unencrypted, and the strength of the master-key derivation depended on each customer's iteration count — old accounts had defaults far below the modern recommendation.

Vendor held a copy of the encrypted vault. Once exfiltrated, attackers could brute-force vaults offline at their own pace.

Attackers accessed Okta's support case management system using stolen credentials and downloaded files including session tokens uploaded by customers debugging issues.

Vendor's internal tooling held customer-uploaded artifacts in cleartext. Internal tooling compromise = customer-data compromise.

Phishing attack compromised employee credentials and granted access to internal tools; in 2024, an unauthenticated endpoint enumerated registered phone numbers for the Authy app.

Vendor-side employee tooling and unauthenticated APIs both presented surfaces where customer identifiers existed in cleartext.

Attackers gained access to a Dropbox Sign production environment and exfiltrated customer email addresses, usernames, phone numbers, hashed passwords, and authentication tokens.

Vendor stored authentication tokens and user identifiers in cleartext in production. Compromise of production = compromise of every active session.

Social-engineering of Mailchimp employees granted attackers access to internal customer-support tooling, including audience lists and marketing analytics for affected accounts.

Vendor-side support tooling could read customer content directly. Compromised employee = compromised customer data.