Stolen credentials and trusted applications can turn ordinary access into extraordinary losses. Protecting the business requires more than securing the login.
Most security programs devote considerable effort to answering one question:
Is this user who they claim to be?
That question is essential. It is not sufficient.
At Change Healthcare, compromised credentials opened the door to an attack that contributed to approximately $3.1 billion in reported response costs and estimated business disruption during 2024. At PowerSchool, compromised support credentials enabled the extraction of student and teacher records—even though the underlying storage was encrypted. In Salesforce customer environments, attackers manipulated employees and compromised trusted integrations to obtain data through ordinary application interfaces.
These incidents illustrate different attack paths, but share a business problem: once an attacker acquired accepted authority, the systems behind it could disclose valuable information at scale.
A successful login is not evidence that the person controlling the account has legitimate intentions. Nor does it establish that the application should be capable of exposing everything the account can reach.
Change Healthcare: a compromised credential, a multibillion-dollar impact
On February 12, 2024, attackers used compromised credentials to enter a Change Healthcare Citrix remote-access portal that lacked multifactor authentication. They subsequently moved laterally, exfiltrated data and deployed ransomware nine days later, according to UnitedHealth Group’s congressional testimony.
The financial consequences extended far beyond incident investigation.
UnitedHealth Group’s 2024 annual report recorded $2.2 billion in direct response costs and $867 million in estimated business disruption impacts at Optum Insight. Together, those figures amount to approximately $3.1 billion for that year—not a final lifetime cost. The company also provided more than $9 billion in interest-free loans to support affected healthcare providers. Those loans were financial assistance, not an additional $9 billion expense, but they demonstrate the scale of the disruption to customers’ cash flow.
For executives, this is the difference between an IT incident and a business crisis. The consequences included restoration expenses, interrupted revenue, customer assistance and the effort required to rebuild essential services.
MFA was a missing and important defense. But the architectural question remains: after an account or server is compromised, how much sensitive information can the attacker reach?
Stronger authentication reduces the probability of entry. It does not, by itself, contain the consequences of entry.
PowerSchool: encrypted storage, readable exports
PowerSchool provides an especially clear example of why encryption at rest does not resolve this problem.
CrowdStrike’s investigation found that an attacker used compromised support credentials to operate PowerSchool’s Maintenance Remote Support functionality and access customer Student Information System instances. The attacker extracted information from Teachers and Students tables.
The investigation found no evidence of system-level access or malware associated with the incident. It also recorded that PowerSchool’s systems and data storage were configured with AES-256 encryption at rest.
The attacker did not need to break AES-256. The support application already possessed the ability to retrieve readable customer records.
The resulting exposure became an extortion opportunity. Federal prosecutors described a demand for approximately $2.85 million in Bitcoin, backed by threats to release student and teacher information. That figure was the ransom demand, not a documented total cost of the incident.
PowerSchool subsequently acknowledged paying a ransom, without disclosing the amount in that statement. Yet by May 2025, multiple school-district customers were receiving further extortion attempts involving the previously stolen data, according to Reuters’ reporting of the company’s announcement.
That sequence exposes a particularly difficult business risk: restoring control of the account does not restore control of copied data.
A password can be reset. A token can be revoked. An attacker’s copy of customer information cannot be reliably recalled. Even payment does not establish that every copy has been destroyed.
For a SaaS provider, the consequences can therefore extend beyond its own incident response. Customers become targets, support teams must address continuing concerns, and the provider must defend the trust on which renewals and future sales depend.
Salesforce: the employee can authorize the attacker
Not every valid-access attack begins with a stolen password.
In the UNC6040 campaigns reported by Google, attackers impersonated IT support personnel and persuaded employees to authorize attacker-controlled Salesforce connected applications. Those applications then used data-management functionality to query and export CRM records. Google observed cases in which attackers progressed from small test queries to extracting entire tables.
A separate campaign in August 2025 used compromised OAuth tokens associated with the Salesloft Drift integration. Attackers extracted large volumes of Salesforce data and searched the stolen material for passwords, AWS access keys and other credentials that could enable further intrusions.
These reports do not establish a reliable campaign-wide financial total. Assigning one would obscure the evidence. The documented damage is nevertheless significant: bulk loss of customer information, exposure of additional secrets and opportunities for subsequent compromise and extortion.
The business lesson is that a trusted integration can become a concentration of risk. Its token may provide persistent access to years of customer information, without requiring the attacker to complete a fresh interactive login.
The business cost is larger than the initial breach
The financial consequences of these attacks are not interchangeable. A ransom demand is not a ransom payment. Customer loans are not incident expenses. Estimated lost revenue is different from a recorded remediation charge.
Nevertheless, the examples reveal a common cost structure:
- Immediate response: investigation, containment, credential rotation and restoration.
- Business interruption: lost transactions, unavailable services and disrupted customer operations.
- Data exposure: notification, customer support and continuing extortion risk.
- Long-term commercial consequences: additional scrutiny, contract reviews and the work required to restore confidence.
A security architecture should therefore address two separate objectives: keeping attackers out and limiting the business damage when they get in.
Legitimate users can also exploit the server’s authority
Credential theft is only one route to aggregated data.
An authenticated user may exploit broken object-level authorization to retrieve another customer’s records. An inadequately protected administrative function may expose a bulk export. OWASP explicitly identifies both object-level and function-level authorization failures as routes to unauthorized disclosure.
SQL injection creates another route. A low-privilege user submits a malicious request, but the resulting query executes with the application’s database privileges. If that application account can read every customer’s records, the attacker may obtain access far beyond the user’s intended permissions. This is why OWASP recommends parameterized queries and narrowly restricted database accounts.
The underlying problem is the gap between what the user is supposed to access and what the server is capable of retrieving.
Application code enforces that distinction—until a vulnerability or compromise bypasses it.
A key vault does not remove decryption authority
Encrypting the database is valuable. So is restricting access to its keys. But neither establishes protection from a compromised workload if that workload must decrypt the data to operate.
Where exportable keys become accessible, an attacker may steal both ciphertext and keys for later decryption. Where an HSM prevents key extraction, the attacker may instead abuse an authorized decryption interface or capture plaintext after the application receives it.
The distinction matters: an attacker does not always need to steal the master key. Using the server’s existing decryption authority may be sufficient.
Microsoft’s 2026 Storm-2949 report illustrates the broader risk. Attackers manipulated Key Vault access configurations, obtained secrets including database connection strings, changed SQL firewall settings and exfiltrated data. One attempted managed-identity route failed because it lacked the required permissions—evidence that least privilege matters—but other compromised authorities provided access.
The executive question should not stop at “Are our keys protected?”
It should continue: “If this server is compromised, can the attacker use its authority to obtain readable data?”
Design on the assumption that the server will be compromised
At Mimir, the architectural starting point is explicit: assume the server will be compromised.
That is a design requirement, not a prediction about the date or method of every future intrusion. Security must remain meaningful after prevention fails.
AI increases the urgency. Google’s 2026 threat research describes attackers using agentic workflows for automated scanning and credential harvesting, reducing human involvement and compressing defenders’ response time. AI does not break sound encryption; it helps attackers find and exploit the paths around it more quickly.
Reduce exposure by removing server-side capability
BrunnrDB is designed to address that problem through ciphertext-only server storage, client-side decryption and processing, and keys that are not available to the central server.
Data is divided into encrypted packages and organized around access requirements. An authorized endpoint receives the cryptographic material it needs, rather than relying on a central application server with universal plaintext access.
With that separation correctly implemented, stealing the central database yields ciphertext. A server-side query cannot directly return sensitive plaintext that the server never possesses. A support account without customer keys cannot turn maintenance access into a readable export of every customer’s records.
The business objective is to prevent infrastructure compromise from automatically becoming mass disclosure.
This does not mean BrunnrDB would have prevented every loss in the incidents described. Ciphertext-only storage does not prevent ransomware outages, deletion or service disruption. A compromised endpoint can expose the plaintext and keys available to it. Recovery systems, secure client delivery, endpoint protection and carefully controlled key distribution remain essential.
Nor can the historical cost figures be presented as amounts BrunnrDB would necessarily have saved. They demonstrate the scale of the stakes, not a quantified counterfactual.
The defensible claim is narrower—and important: removing universal server-side decryption authority removes a major path from compromised infrastructure to aggregated customer data.
Authentication determines whether a request is accepted. Authorization determines what the requester is supposed to receive.
Architectural cryptography determines what a compromised identity or server can actually obtain.
For a business entrusted with sensitive information, that difference can determine whether one compromised account remains a contained incident or becomes an enterprise-wide crisis.
Sources
- Andrew Witty’s congressional testimony, May 1, 2024.
- UnitedHealth Group 2024 Form 10-K, Change Healthcare Cyberattack.
- CrowdStrike, PowerSchool investigation report.
- U.S. Department of Justice, Worcester College Student Sentenced to Four Years in Prison for Cyber Extortions.
- Reuters, US school districts facing extortion attempt after hack, software provider says, May 7, 2025.
- Google Threat Intelligence Group, The Cost of a Call: From Voice Phishing to Data Extortion.
- Google Threat Intelligence Group, Widespread Data Theft Targets Salesforce Instances via Salesloft Drift.
- OWASP API1:2023, Broken Object Level Authorization.
- OWASP API5:2023, Broken Function Level Authorization.
- OWASP, SQL Injection Prevention Cheat Sheet.
- Microsoft, How Storm-2949 turned a compromised identity into a cloud-wide breach, May 18, 2026.
- Google Threat Intelligence Group, From Prompting to Autonomy — The Evolution of Adversarial AI.
