Lessons from the biggest data leaks 2024/2025: how to avoid the mistakes of the biggest companies?

Headlines about another gigantic data leak at a well-known corporation have become alarmingly common. It’s easy to read about these incidents from a distance, thinking that they involve only the biggest players with unlimited budgets. This, however, is a mistake. Each such incident is a public, free and extremely valuable lesson for companies of all sizes. By analyzing what went wrong in organizations that theoretically should have the best security in the world, we gain unique insights into the real-world tactics of attackers and, more importantly, the universal vulnerabilities that afflict businesses regardless of scale.

This article is not a chronicle of failures, but a pragmatic guide to lessons learned. Instead of focusing on sensational details, we will analyze the root causes and recurring patterns that led to the most notorious security incidents of 2024 and 2025. The goal is to translate the mistakes made by others into concrete, implementable actions. This is the essence of building a security strategy – learning from the stumbles of the greatest so that you don’t have to go through this painful path yourself.

What common denominator links most of the high-profile incidents of recent years?

When analyzing the causes of major hacks in depth, one recurring theme immediately strikes: a failure to enforce basic cybersecurity principles. Although attacks are often described as extremely sophisticated, their starting point is almost always a mundane and preventable error. It’s not the finesse of zero-day exploits, but stolen passwords, a lack of multi-component authentication, systems that haven’t been patched for months, or a successful social engineering attack that opens the door to the best-guarded networks.

This seems paradoxical. Companies are investing millions in state-of-the-art systems based on artificial intelligence, yet their key systems do not have MFA enabled, and administrators are using the same simple passwords across multiple sites. This gap between perceived and actual security maturity is the biggest threat. Attackers are well aware of this and almost always take the path of least resistance.

The lesson from these incidents is brutally simple: no advanced technology can protect an organization that neglects the fundamentals. Before investing in the next “magic” solution, we need to ask ourselves whether we are 100% sure we have implemented and are enforcing basic controls, such as comprehensive identity management, strict patching policies or network segmentation.

Why is identity theft and poor access management still the leading cause of hacking?

Identity has become the new perimeter of the network (identity is the new perimeter). The vast majority of high-profile attacks don’t start by breaking a firewall, but by logging into corporate systems using legitimate but stolen credentials. Hackers no longer need to “hack” – all they need to do is log in. Credentials (username and password) are a bulk commodity, available for little money on darknet forums, obtained from previous leaks or stolen on the fly through phishing and malware.

Analysis of the 2024-2025 incidents shows that the biggest mistake defenders have made is the inconsistent implementation of multi-factor authentication (MFA). Many organizations have deployed MFA only for critical applications or privileged users, leaving “less critical” systems such as VPNs, HR portals or testing systems protected only by passwords. Attackers exploit these vulnerabilities by taking control of a seemingly insignificant account and then spreading inside the network.

Another mistake is to rely on weak forms of MFA, such as SMS codes or push notifications without additional verification, which are susceptible to MFA fatigue attacks (flooding the user with acceptance requests until they succeed). The most important lesson is clear: mandatory phishing-resistant MFA (e.g., based on the FIDO2 standard) must be implemented for all users and all systems without exception.

What role did supply chain and partner (third-party) attacks play in the biggest leaks?

No company is a solitary island. Each operates in a complex ecosystem of suppliers, partners and subcontractors, any one of which can become the weakest link. High-profile incidents in recent years have vividly demonstrated that attackers are increasingly taking this route – infiltrating a smaller, less protected partner in order to attack their proper, much more secure target.

These attacks take many forms. It can be the compromise of a software provider, as in the case of SolarWinds, where malicious code was hidden in a legitimate update. It could be an attack on a managed service provider (MSP) that has privileged access to the networks of dozens of its customers. Smaller partners such as law firms, marketing agencies or recruitment firms that store sensitive data of their larger clients are also increasingly becoming targets.

The lesson is clear: Third-Party Risk Management must become a priority. It is no longer enough to send a vendor a security survey once a year. A continuous monitoring process must be implemented, audit rights must be required in contracts, SOC 2 reports must be analyzed, and in-house security testing must be conducted for key partners. A company’s security is only as strong as the security of its weakest supplier.

What do cloud service misconfiguration incidents teach us?

Migration to the public cloud (AWS, Azure, GCP) has brought tremendous flexibility to companies, but it has also created a whole new class of risk from configuration errors. Cloud providers operate under a shared responsibility model – they secure the cloud infrastructure, but the customer is 100% responsible for configuring their cloud services and data securely.

Analysis of recent leaks shows that the most common mistakes are alarmingly simple. Publicly accessible S3 storage (or Azure Blob Storage) containing sensitive customer data is a classic of the genre. Other common mistakes include databases exposed to the public Internet without passwords, overly broad permissions in IAM (Identity and Access Management) policies that give one user or service access to everything, or unencrypted disk volumes.

These mistakes are most often due to lack of knowledge, haste and insufficient visibility into the complex cloud environment. The lesson is the need to invest in Cloud Security Posture Management (CSPM) – tools that automatically scan the cloud environment for configuration errors and non-compliance with best practices. Dedicated training is also needed for DevOps teams and cloud engineers to build secure solutions from the ground up (security by design).

How did social engineering attacks on technical support (helpdesk) employees become a powerful new vector?

As multi-factor authentication (MFA) becomes the standard, attackers are looking for creative ways to circumvent it. One of the most effective techniques, and the one most frequently seen in recent incidents, is to attack not the technology, but the process – specifically, the credential reset process performed by the technical support department.

The scenario is simple, but extremely effective. The attacker, having basic data about the employee (which can easily be found on LinkedIn), calls the company’s helpdesk, impersonating that person. Using an excuse (e.g., “I lost my MFA token phone,” “my laptop broke”), he convinces the support employee to reset the password and assign a new MFA device to the account. After successful manipulation, the hacker gains full access, bypassing even the strongest technical security.

The lesson from these attacks is twofold. First, helpdesk staff must be treated as security-critical personnel and receive intensive training in recognizing tampering attempts. Second, credential reset and MFA registration processes must be extremely rigorous. Identity verification cannot be based on simple questions. It should require video confirmation with a manager, verification by the HR department or other multi-step, hard-to-falsify procedures.

What incident response (incident response) mistakes do attacked companies make most often?

How a company responds to an incident often determines whether it will be a severe but manageable failure or a disaster with existential consequences. An analysis of high-profile intrusions reveals several recurring, critical mistakes in the response phase.

The first is communication that is too slow or chaotic, both internally and externally. The lack of a clear crisis communication plan leads to rumors, misinformation and loss of trust from customers, partners and regulators. The second common mistake is incomplete containment (containment) of the threat. IT teams, acting under pressure, try to restore systems from backup too quickly, without ensuring that all backdoors and attacker persistence mechanisms have been removed. This leads to immediate re-infection and the need to start the whole process over again.

The third mistake is destroying digital evidence (forensics). Hastily restarting servers, restoring systems from images, or deleting logs prevents later analysis and a thorough understanding of how the attack occurred, the extent of the attack, and what data was stolen. The lesson is simple: every company, regardless of size, must have a prepared and rehearsed incident response plan that clearly defines roles, procedures and priorities in the event of a crisis.

How does nFlo help companies implement lessons from high-profile leaks before they become victims themselves?

At nFlo, we believe that the best way to learn is to learn from others’ mistakes. Our portfolio of services is designed to identify, in a controlled and secure way, the same weaknesses in an organization that brought down the biggest ones before the real attackers do. We act as a sparring partner to help strengthen defenses before the real fight.

Our Red Teaming services and advanced penetration testing simulate the activities of real hacker groups. We don’t just look for simple vulnerabilities – we test overall resilience, attempting to bypass security via social engineering, supply chain attacks or identity theft. In this way, we identify fundamental gaps in processes and technologies that often remain invisible during standard audits.

As part of security audits and architecture analysis, we verify that the foundation of cyber security is solid. We check the configuration of cloud services, the maturity of the vulnerability management process and the effectiveness of network segmentation. Most importantly, we help prepare for the worst. Our team helps create and test response plans (IR Plans) through simulation exercises (table-top). This way, when a real crisis hits, the client’s team knows exactly what to do, avoiding chaos and costly mistakes.