Every breach you've read about has the same root cause.

The vendor was holding decryptable copies of customer secrets. Attacker breach yielded the keys + the data; cryptography didn't bound the exposure.

The vendor's runtime services hold customer content as cleartext to operate. Attacker access to those services yielded readable customer data directly.

The vendor's identity provider or auth-adjacent third party was breached; downstream customer accounts inherited the trust failure.

A data-warehouse or cloud-service vendor holding customer data on behalf of many downstream tenants was breached; every tenant's data was exposed at once.

A vendor employee with legitimate admin access abused their position. The cryptographic boundary didn't exclude that role from cleartext access.

Snowflake is a service big companies use to store their customer data. Hackers got the login passwords for about 165 of Snowflake's customer accounts that didn't have two-factor auth turned on. With those passwords, they walked in and copied huge customer databases. AT&T lost 110 million call records. Ticketmaster lost 560 million customer accounts. Snowflake itself wasn't broken into; the customers' passwords were. But once an attacker had a valid login, all the data was sitting there as plain readable rows.

Russian state-linked hackers got into Microsoft's own internal email — for weeks. They read messages from Microsoft's senior leadership and security teams. Microsoft eventually disclosed that the same attackers got into some of Microsoft's source code. The attack worked because Microsoft's own employees, like all Microsoft 365 customers, use Exchange Online where Microsoft holds the keys.

Okta is the company most large businesses use to sign people in to all their other apps. Attackers got into Okta's customer-support system and stole files customers had shared with Okta's support staff. Those files contained login session info that let attackers try to break in to those customers' own systems.

Hackers linked to the Chinese government stole a master key Microsoft uses to prove its own identity to its services. With that key, they could fake being any Microsoft customer — including U.S. federal agencies — and read their email. They had access for about a month before anyone noticed. The key existed because Microsoft holds it; if Microsoft hadn't held the key, the attackers wouldn't have had anything to steal.

Attackers got login credentials for a few Slack employees and used them to read Slack's source code on GitHub. Slack disclosed that no customer messages were accessed — they keep source separate from production data. A bounded incident, included here as an example of what happens when a company keeps the right separations.

Attackers stole copies of every LastPass user's password vault. The passwords inside the vaults stayed encrypted, but the URLs of every site each user had a password for — plus their names and emails — were stored in plain text, and those leaked.