Weak passwords and data breaches: parsing real incidents
Russian-language materials about password policy are usually reduced to the template of the document: requirements for length, ban on stickers, employee responsibility. No one is aware of the specific incidents with the TTPs of the attackers. The three cases below show exactly how weak passwords become the entry point - and which processes have been broken. More details - in our review of the authentication attack.
SolarWinds: default administrator password in supply chain
Password solarwinds123 stood on the internal SolarWinds update server and got into a public repository. The attack was multi-stage - it's not the only reason for the supply chain compromise - but the administrator's default password has become one of the entry points. The result: Compromising Orion updates, thousands of organizations, including government agencies, have been affected.
Classic: Accounting data management is spelled out on paper, but not technically applied. The password passed by the audit, because there was no domain policy on the update server.
Verkada and Mirai: default credentials
In 2021, a group of attackers gained access to more than 150,000 Verkada CCTV cameras. The reason is that the credentials of the superadministrator with full access to the customer cameras were found in the public domain. The same vector operated the Mirai botnet, massively breaking the IoT devices with factory admin:admin and root:root. In both cases, the company’s password policy simply did not apply to the IoT segment: the devices unfolded without changing default passwords, service records were not controlled by SIEM.
M&S and Co-op: credential stuffing and weak password resetting process
In recent attacks on British retailers Marks & Spencer, Co-op and Harrods, the attackers went through social engineering: impersonated employees and persuaded IT helpesque to drop passwords to accounts (according to CyberLab, with reference to rradar). They bypassed the standard authentication procedures, gained access to customer data, payment information and logins. Compromised credentials were reused on several platforms - the scale of the leak has multiplied.
The problem is not only in weak passwords, but also in the absence of strict verification when resetting. If the password policy does not cover the procedure of restoring access - it is incomplete.
The scale of the problem in the figures
Metric Significance Source
Proportion of leaks through weak/stolen passwords more than 80% according to estimates of industry reports (data vary)
Attacks through compromised credentials (2025) 88% according to unconfirmed data of industry reports
Entries with Darknet Passwords (2022) 24.6 billion according to unconfirmed data of industry reports
Increase in the probability of an incident when reusing 2.56x according to unconfirmed data of industry reports
Risk reduction of credential attacks with MFA up to 99% Microsoft and industry reports estimate
According to the data Have I Been Pwned, in March 2026 alone, the leak of the Colombian fintech Addi affected 34.5 million records, including email addresses and state ID documents (there were no passwords in this leak, but compromised emails are used in credential stuffing). The Russian online cinema START lost data of about 7.46 million users (leakage of 2021, publicly became known in August 2022; 7 455 386 records on HIBP), including passwords. Each such leak is a direct consequence of the fact that protecting accounts from hacking was not a priority.
TTPs credential-attacks and detection in SIEM
Account Compromise: Business Logic
Why the attacking password? Motivation is direct: get valid credentials for initial access, gain a foothold in infrastructure and move laterally. In the case of credential stuffling, monetization is even easier - selling access to the darknet, takeover accounts in financial services.
Credential stuffing - automatic substitution of pairs login
assword from leaks to authorization forms of other services. Calculating that the user is dragging one password to all platforms. Password spraying is another approach: one popular password (the same Company2024! or Summer2025) is driven through all domain accounts. Brutforce attack in pure form - overkill of all combinations - is rarer because it is easy to catch a blockage. Spraying is more tricky: one or two attempts to take into account, the lock threshold does not work.
According to the OWASP classification, this A07:2021 (Identification and Authentication Failures) - weak passwords, credential stuffing, lack of MFA.
Tools I use on pentes for these techniques: Hydra for network protocols, CrackMapExec for password testing by SMB/WinRM in domain, Kerbrute for AS-REP spraying in Kerberos. Everyone works with rockyou.txt and custom dictionaries from leaks.
Detection Checklist: Correlation Rules for SIEM
Detection credential attacks are based on anomalies relative to baseline (NIST CSF v2.0, DE.AE-01 - setting the baseline of network operations and expected data flows).
Password spraying - many unsuccessful attempts to enter to different accounts from one IP in a short period. Key EventID in Windows Security Log - 4625 (Failed Logon):
YAML:
# Sigma: password spraying
title: Password Spraying - Multiple Failed Logins
logsource:
product: windows
service: security
detection:
selection:
EventID: 4625
condition: selection | count(distinct TargetUserName) by IpAddress > 5 поддерживает distinct - count()
timeframe: 10m
level: high
Credential stuffing is an abnormally high frequency of authentication from atypical geo-zones or from IP addresses previously seen in abuse. Check through AbuseIPDB with abuseConfidenceScore > 75 as a threshold for blocking. For web applications - the correlation HTTP 401/403 with a frequency above baseline.
What to monitor to protect accounts from hacking:
EventID 4625 (Failed Logon) - grouping by TargetUserNameand IpAddress
EventID 4740 (Account Lockout) - mass locks = spraying indicator
EventID 4624 (Successful Logon) with LogonType 10 (Remote) from atypical subnets
Sequence: 4625 -> unit 4624 series = successful password selection
Authentication at an uncharacteristic time (night hours for a specific user)
One user, many sources of entry in a short period - a possible reuse of the dropped passwords
Implementation of password policy: NIST SP 800-63B and Active Directory
Password Complexity Requirements: What NIST Says
NIST SP 800-63B (Digital Identity Guidelines) Radically revised the approach to passwords. Key recommendations that diverge from the company’s “traditional” password policy are:
Minimum length - at least 8 characters for user passwords (NIST SP 800-63B). CIS recommends 14+ for MFA and 8+ MFA accounts. Length is the main factor of resistance to overtake, more important than the composition of symbols
Refusal of forced rotation - password change only with confirmed compromise, not on the calendar. Forced shift every 90 days generates predictable patterns: Winter2024-> Spring2024-> Summer2024
Refusal of mandatory rules of the composition - the requirement "capital + lowercase + figure + special symbol" leads to passwords of the species Password1!, formally suitable for politics, but selected in seconds. NIST indicates that the benefits of rigid rules of the composition are limited
Checking the block list - each new password is compared with the list of compromised (Have I Been Pwned API), a dictionary of popular passwords and context-dependent values (company name, login)
The maximum length of at least 64 characters is the limit of the maximum password length, according to OWASP, one of the most harmful practices
In NIST SP 800-53 Rev 5 it is covered by the controls IA-1 (Identification and Authentication Policy) and AC-1 (Access Control Policy), which require documentation of authentication policies with clear roles and responsibility. The manager of corporate passwords closes the problem of remembering long passwords - the user remembers one master password, the rest are generated automatically.
Fine-Grained Password Policy in Active Directory
The standard Default Domain Password Policy applies to the entire domain in the same way. Fine-Grained Password Policy (FGPP) allows you to set different requirements for the complexity of the password for different groups: tougher for administrators and service accounts, softer for ordinary users with MFA.
Minimum FGPP parameters for different account types:
Parameter Users Administrators Service Accounts
Minimum length 12 characters 16 characters 24+ characters
History of passwords 10 24 Rotation on regulations
Blocking (attempts / window) 5 for 15 min 3 in 10 minutes 3 in 5 minutes
Lock duration 30 min 60 min Before manual unlocking
MFA Recommended Required No (interactive entry ban)
For service records critically: prohibition of interactive entry (Deny log on locally), possession of passwords in Vault or secret manager (not in scripts and not in GPO Preferences), rotation when changing the owner or compromise. After each deployment of the new server, I run a PowerShell script that checks for blank or default password accounts. Finds - stable.
MFA implementation: two-factor authentication
Two-factor authentication is a control that estimates industry reports reduce the risk of credential attacks by up to 99%. Priority of implementation of MFA:
VPN and remote access - the first vector of login to the corporate network
Administrative accounts - Domain Admins, Enterprise Admins
Corporate Mail - Login point for BEC
Systems with critical data - CRM, ERP, financial applications
When choosing the second factor: FIDO2 hardware keys are resistant to phishing, TOTP applications (Google Authenticator, Microsoft Authenticator) - an acceptable compromise, SMS codes are the worst option due to a vulnerability to SIM swap. NIST CSF v2.0 (PR.AA-01) expressly indicates the management of identification and authentication as a mandatory protection element.
Legal context: FZ-152 "On personal data" obliges the PD operator to take organizational and technical protection measures - the password policy is among them. For the subjects of KII FSTEC carries out inspections of compliance with safety requirements on FZ-187 (art. 14). GDPR fines reach 4% of annual turnover, PCI DSS (Requirement 8) requires unique IDs and MFAs for remote access.
Russian-language materials about password policy are usually reduced to the template of the document: requirements for length, ban on stickers, employee responsibility. No one is aware of the specific incidents with the TTPs of the attackers. The three cases below show exactly how weak passwords become the entry point - and which processes have been broken. More details - in our review of the authentication attack.
SolarWinds: default administrator password in supply chain
Password solarwinds123 stood on the internal SolarWinds update server and got into a public repository. The attack was multi-stage - it's not the only reason for the supply chain compromise - but the administrator's default password has become one of the entry points. The result: Compromising Orion updates, thousands of organizations, including government agencies, have been affected.
Classic: Accounting data management is spelled out on paper, but not technically applied. The password passed by the audit, because there was no domain policy on the update server.
Verkada and Mirai: default credentials
In 2021, a group of attackers gained access to more than 150,000 Verkada CCTV cameras. The reason is that the credentials of the superadministrator with full access to the customer cameras were found in the public domain. The same vector operated the Mirai botnet, massively breaking the IoT devices with factory admin:admin and root:root. In both cases, the company’s password policy simply did not apply to the IoT segment: the devices unfolded without changing default passwords, service records were not controlled by SIEM.
M&S and Co-op: credential stuffing and weak password resetting process
In recent attacks on British retailers Marks & Spencer, Co-op and Harrods, the attackers went through social engineering: impersonated employees and persuaded IT helpesque to drop passwords to accounts (according to CyberLab, with reference to rradar). They bypassed the standard authentication procedures, gained access to customer data, payment information and logins. Compromised credentials were reused on several platforms - the scale of the leak has multiplied.
The problem is not only in weak passwords, but also in the absence of strict verification when resetting. If the password policy does not cover the procedure of restoring access - it is incomplete.
The scale of the problem in the figures
Metric Significance Source
Proportion of leaks through weak/stolen passwords more than 80% according to estimates of industry reports (data vary)
Attacks through compromised credentials (2025) 88% according to unconfirmed data of industry reports
Entries with Darknet Passwords (2022) 24.6 billion according to unconfirmed data of industry reports
Increase in the probability of an incident when reusing 2.56x according to unconfirmed data of industry reports
Risk reduction of credential attacks with MFA up to 99% Microsoft and industry reports estimate
According to the data Have I Been Pwned, in March 2026 alone, the leak of the Colombian fintech Addi affected 34.5 million records, including email addresses and state ID documents (there were no passwords in this leak, but compromised emails are used in credential stuffing). The Russian online cinema START lost data of about 7.46 million users (leakage of 2021, publicly became known in August 2022; 7 455 386 records on HIBP), including passwords. Each such leak is a direct consequence of the fact that protecting accounts from hacking was not a priority.
TTPs credential-attacks and detection in SIEM
Account Compromise: Business Logic
Why the attacking password? Motivation is direct: get valid credentials for initial access, gain a foothold in infrastructure and move laterally. In the case of credential stuffling, monetization is even easier - selling access to the darknet, takeover accounts in financial services.
Credential stuffing - automatic substitution of pairs login
assword from leaks to authorization forms of other services. Calculating that the user is dragging one password to all platforms. Password spraying is another approach: one popular password (the same Company2024! or Summer2025) is driven through all domain accounts. Brutforce attack in pure form - overkill of all combinations - is rarer because it is easy to catch a blockage. Spraying is more tricky: one or two attempts to take into account, the lock threshold does not work.According to the OWASP classification, this A07:2021 (Identification and Authentication Failures) - weak passwords, credential stuffing, lack of MFA.
Tools I use on pentes for these techniques: Hydra for network protocols, CrackMapExec for password testing by SMB/WinRM in domain, Kerbrute for AS-REP spraying in Kerberos. Everyone works with rockyou.txt and custom dictionaries from leaks.
Detection Checklist: Correlation Rules for SIEM
Detection credential attacks are based on anomalies relative to baseline (NIST CSF v2.0, DE.AE-01 - setting the baseline of network operations and expected data flows).
Password spraying - many unsuccessful attempts to enter to different accounts from one IP in a short period. Key EventID in Windows Security Log - 4625 (Failed Logon):
YAML:
# Sigma: password spraying
title: Password Spraying - Multiple Failed Logins
logsource:
product: windows
service: security
detection:
selection:
EventID: 4625
condition: selection | count(distinct TargetUserName) by IpAddress > 5 поддерживает distinct - count()
timeframe: 10m
level: high
Credential stuffing is an abnormally high frequency of authentication from atypical geo-zones or from IP addresses previously seen in abuse. Check through AbuseIPDB with abuseConfidenceScore > 75 as a threshold for blocking. For web applications - the correlation HTTP 401/403 with a frequency above baseline.
What to monitor to protect accounts from hacking:
EventID 4625 (Failed Logon) - grouping by TargetUserNameand IpAddress
EventID 4740 (Account Lockout) - mass locks = spraying indicator
EventID 4624 (Successful Logon) with LogonType 10 (Remote) from atypical subnets
Sequence: 4625 -> unit 4624 series = successful password selection
Authentication at an uncharacteristic time (night hours for a specific user)
One user, many sources of entry in a short period - a possible reuse of the dropped passwords
Implementation of password policy: NIST SP 800-63B and Active Directory
Password Complexity Requirements: What NIST Says
NIST SP 800-63B (Digital Identity Guidelines) Radically revised the approach to passwords. Key recommendations that diverge from the company’s “traditional” password policy are:
Minimum length - at least 8 characters for user passwords (NIST SP 800-63B). CIS recommends 14+ for MFA and 8+ MFA accounts. Length is the main factor of resistance to overtake, more important than the composition of symbols
Refusal of forced rotation - password change only with confirmed compromise, not on the calendar. Forced shift every 90 days generates predictable patterns: Winter2024-> Spring2024-> Summer2024
Refusal of mandatory rules of the composition - the requirement "capital + lowercase + figure + special symbol" leads to passwords of the species Password1!, formally suitable for politics, but selected in seconds. NIST indicates that the benefits of rigid rules of the composition are limited
Checking the block list - each new password is compared with the list of compromised (Have I Been Pwned API), a dictionary of popular passwords and context-dependent values (company name, login)
The maximum length of at least 64 characters is the limit of the maximum password length, according to OWASP, one of the most harmful practices
In NIST SP 800-53 Rev 5 it is covered by the controls IA-1 (Identification and Authentication Policy) and AC-1 (Access Control Policy), which require documentation of authentication policies with clear roles and responsibility. The manager of corporate passwords closes the problem of remembering long passwords - the user remembers one master password, the rest are generated automatically.
Fine-Grained Password Policy in Active Directory
The standard Default Domain Password Policy applies to the entire domain in the same way. Fine-Grained Password Policy (FGPP) allows you to set different requirements for the complexity of the password for different groups: tougher for administrators and service accounts, softer for ordinary users with MFA.
Minimum FGPP parameters for different account types:
Parameter Users Administrators Service Accounts
Minimum length 12 characters 16 characters 24+ characters
History of passwords 10 24 Rotation on regulations
Blocking (attempts / window) 5 for 15 min 3 in 10 minutes 3 in 5 minutes
Lock duration 30 min 60 min Before manual unlocking
MFA Recommended Required No (interactive entry ban)
For service records critically: prohibition of interactive entry (Deny log on locally), possession of passwords in Vault or secret manager (not in scripts and not in GPO Preferences), rotation when changing the owner or compromise. After each deployment of the new server, I run a PowerShell script that checks for blank or default password accounts. Finds - stable.
MFA implementation: two-factor authentication
Two-factor authentication is a control that estimates industry reports reduce the risk of credential attacks by up to 99%. Priority of implementation of MFA:
VPN and remote access - the first vector of login to the corporate network
Administrative accounts - Domain Admins, Enterprise Admins
Corporate Mail - Login point for BEC
Systems with critical data - CRM, ERP, financial applications
When choosing the second factor: FIDO2 hardware keys are resistant to phishing, TOTP applications (Google Authenticator, Microsoft Authenticator) - an acceptable compromise, SMS codes are the worst option due to a vulnerability to SIM swap. NIST CSF v2.0 (PR.AA-01) expressly indicates the management of identification and authentication as a mandatory protection element.
Legal context: FZ-152 "On personal data" obliges the PD operator to take organizational and technical protection measures - the password policy is among them. For the subjects of KII FSTEC carries out inspections of compliance with safety requirements on FZ-187 (art. 14). GDPR fines reach 4% of annual turnover, PCI DSS (Requirement 8) requires unique IDs and MFAs for remote access.
