The breaches, in order.
From Codecov (2021, which kicked off the CI/CD NHI conversation) through to Shai-Hulud 2.0 (November 2025, still the largest npm secrets-harvesting worm). Each study frames the incident through the NHI governance lens.
Shai-Hulud 2.0, the self-replicating npm worm
A second-generation supply-chain worm propagated through the npm ecosystem, compromising approximately 25,000 repositories and exfiltrating credentials tied to more than 1,000 organisations (Entro Security). Introduced a dead-man's-switch mechanism designed to detonate if maintainers attempted to cleanse the infected packages.
Salesloft / Drift, OAuth at supply-chain scale
UNC6395 (Mandiant-tracked, also reported as GRUB1) compromised Drift and used OAuth refresh tokens to access the CRM data of 700+ downstream organisations, including Cloudflare, Google, Tanium, Zscaler, and Palo Alto Networks. The archetypal third-party NHI incident.
Snowflake UNC5537, single-factor creds at cloud scale
Threat actor UNC5537 compromised at least 165 Snowflake customer tenants using static single-factor credentials harvested by infostealer malware. Victims included AT&T (approximately 110M customer records, $370K reported ransom), Ticketmaster (approximately 560M records), and LendingTree. A canonical demonstration that customer-side MFA enforcement matters.
Okta support system, service account on a personal Google
A service-account credential for Okta's customer support system was stored in an engineer's personal Google account, compromised, and used to access customer HAR files containing session-token data. A textbook NHI10 (human use of NHI) case.
Microsoft Storm-0558, a 2016 key, used in 2023
A Microsoft Services Account consumer-key signing key from 2016 was used by Chinese-linked threat actor Storm-0558 to forge authentication tokens against Exchange Online and access approximately 60,000 US State Department emails. The archetypal orphaned-NHI case at nation-state scale.
Codecov Bash Uploader, the CI/CD wake-up call
Attackers modified Codecov's Bash Uploader script to exfiltrate environment variables, including credentials, from hundreds of customer CI/CD pipelines for months before detection. The incident that put secrets-in-CI on the enterprise security agenda.
Three patterns, nine incidents.
Across these six case studies (and the wider set in our archive), three patterns account for the overwhelming majority of root causes: static credentials leaking to attacker-reachable locations; identities that outlived their purpose; over-privileged service accounts that granted lateral movement. Every programme should be able to explain how it addresses each of the three.
Leaked static credentials
Codecov. Shai-Hulud. Codecov. The credential-in-code-or-container pattern that secrets management is designed to eliminate.
Orphaned identities
Storm-0558. Seven years past its useful life, the signing key remained trusted. Offboarding is the lifecycle stage where governance most often fails.
Over-privilege & lateral movement
Snowflake. Okta support. Privileges broader than the use case, compromised credential, environment-wide exposure.
From our team at HumanAudit
From understanding NHI risk to documented compliance
This hub is free and vendor-neutral. When you need audit-ready documentation, our two commercial sister sites publish the templates compliance and security teams attach to their audit files.
Frequently asked questions
What is the biggest non-human identity breach?
There is no single answer, and the useful comparison is by pattern rather than by scale. Storm-0558 is the most severe by trust impact, because a signing key compromise bypasses everything downstream. The Snowflake campaign attributed to UNC5537 is the broadest by number of affected organisations. Codecov is the most instructive for CI/CD credential concentration, and Salesloft/Drift for third-party OAuth exposure.
What do these breaches have in common?
Four elements recur across nearly all of them. A credential existed that should not have, or should not have had that scope. It was usable from anywhere without a second factor. Its permissions exceeded its function. And nobody owned it, so revocation was slow. Almost none of these incidents required a software vulnerability.
Are non-human identity attacks increasing?
The number of publicly disclosed incidents where a machine credential was the initial access or lateral movement vector has grown consistently since 2021, and the category now features in most major supply-chain incidents. Precise proportions vary by source and by how incidents are classified, so we cite the individual cases rather than an aggregate figure whose methodology we cannot inspect.
How should we use these case studies internally?
As control tests rather than as awareness material. For each incident, ask whether the specific enabling condition exists in your environment: do you have single-factor machine accounts reachable from the internet, do CI/CD jobs hold standing production credentials, do you know every third-party OAuth grant and its scope, and are diagnostic artefacts sanitised before they leave. Each question has a checkable answer.
Would this credential have been in your inventory?
Every breach on this page began with a non-human identity nobody was tracking. HumanAudit runs independent NHI baseline assessments that produce a measured inventory, an ownership map, and a tested revocation time.