We pulled every public breach disclosure filed in the EU and the US between January 2025 and June 2026 where the filing included a technical cause. That left 240 documents.
We were looking for novelty. We did not find much.
The distribution
Four causes account for 71 percent of the set.
- Over-broad service credentials (31 percent). A token issued for one job, reused for six, and scoped to an entire account rather than a prefix.
- Forgotten replicas (18 percent). A snapshot, a staging restore, or an analytics copy that inherited none of the production controls.
- Export paths without limits (13 percent). A reporting feature that will happily return the whole table if you ask it politely.
- Schema changes that silently widened access (9 percent). A column added to a view, a view already shared with a wider group.
The remaining 29 percent is a long tail. Some of it is genuinely sophisticated. Most of it is unique enough that there is no general lesson.
What the tail tells you
The interesting finding is not the top four. Everyone half expects those.
It is that the sophisticated attacks in the tail almost always began with one of the top four. The novel part was what happened after the initial access, not how it was obtained. Attackers do not need a new front door when the existing one has 31 percent odds.
This reframes the defensive question. Detecting a sophisticated lateral movement is hard and requires good tooling. Noticing that a service token scoped to one prefix is suddenly reading four is not hard, and it happens earlier.
Time to detection
Median time from initial access to detection across the set was 34 days. Median time from detection to disclosure was 11.
The 34 is the number worth attacking. In the subset where the organisation had row level or object level access logging in place, median time to detection dropped to 6 days. That is not a claim about causation from our data, and the sample is self selecting: organisations with that logging tend to have other things too.
But the direction is consistent and the mechanism is obvious. You cannot notice an anomaly in a signal you are not recording.
What we would prioritise
If you have budget for exactly one thing this year, make it credential scoping. It is unglamorous, it is the largest single bucket, and unlike detection tooling it reduces the blast radius rather than shortening the timeline.
If you have budget for two, add per object access logging on your three largest stores. Not all of them. Three is enough to learn what normal looks like, and learning that is most of the work.
