<img src="https://ws.zoominfo.com/pixel/6169bf9791429100154fc0a2" width="1" height="1" style="display: none;">

Achieve Zero Trust in AWS 🔒 Join our hands-on workshop on February 27!

Search
Close icon
Search bar icon

Five Spine-Chilling Credential Theft Stories

StrongDM manages and audits access to infrastructure.
  • Role-based, attribute-based, & just-in-time access to infrastructure
  • Connect any person or service to any infrastructure, anywhere
  • Logging like you've never seen

“It is, I confess, with considerable diffidence, that I approach the strange narrative which I am about to relate. The events which I purpose detailing are of so extraordinary a character that I am quite prepared to meet with an unusual amount of incredulity and scorn. I accept all such beforehand.” Fitz-James O’Brien, What Was It?

Gather ‘round for five, real-life stories of data breach that will haunt your dreams. You’ll find no ghosts, ghouls, or vampires here—though there may be zombies

Read on if you dare…

Marriott: A Haunted Hotel

Marriott acquired Starwood Hotels in 2016 and inherited its faulty IT infrastructure, including a legacy guest reservation system that had been unknowingly compromised in 2014. Per CSO Online, “Starwood’s old system limped on, zombie-like, infected with malware, breached by hackers, and without much by way of continuity of care…” until 2018, when an internal security tool finally detected the problem. By then, attackers had encrypted and most-likely removed password and credit card data from millions of guest records. And the fright doesn’t end there. Marriott continues to face fines, lawsuits, and lost revenue related to the breach. Yikes.

Volkswagen: Is It Possible to Steal a Deceased Person’s Identity?

Apparently so. In March 2021, Audi and Volkswagen learned that an attacker may have obtained the personal data of more than three million individuals in the U.S. and Canada. A marketing services company under Volkswagen’s employ left personal information from potential customers unprotected for 21 months before the leak was discovered. The exposure included driver’s license numbers and in some cases birth dates, Social Security numbers, account or loan numbers, and tax IDs from victims both living and dead.

Stradis Healthcare: The Call Came From Inside the House

In March of 2020, a VP at Stradis Healthcare was fired. Before leaving, he created a fake-user admin account on the company’s network. He then was able to create a second illegitimate account which he used to sabotage thousands of records, causing hundreds of thousands of dollars in damage and delaying the shipment of much-needed supplies to healthcare customers. A ghoulish act indeed.

Kroger: Misery Loves Company?

In early 2021, Kroger joined the growing list of Accellion attack victims. The breach has impacted more than a hundred companies, universities, organizations, and even government agencies. Exposed data included human resources information, pharmacy records, and financials services records. So far, the breach has cost Kroger $5 million. 

Capturerx: What Lurks in the Dark?

Health IT company CaptureRx helps hospitals manage their 340B drug pricing program claims. But in February 2021, a ransomware attack exposed thousands of patient files. The compromised files contained protected health data including patient names, birthdates, and prescription information. So far, this ransomware attack on a third-party vendor has impacted more than million patients at multiple healthcare institutions.

"I can assure you," said I, "that it will take a very tangible ghost to frighten me.” H.G. Wells, The Red Room

Take heart dear reader. Although credential-based attacks can happen to anyone, with a little planning and the right tools, you can catch them early and often prevent them altogether.

Want to learn more? Sign up for our no BS demo and see for yourself. And stay tuned for our next seasonal blog post: Turkey with a Side of Credential Stuffing … or maybe not.


About the Author

, Contributing Writer and Illustrator, has a passion for helping people bring their ideas to life through web and book illustration, writing, and animation. In recent years, her work has focused on researching the context and differentiation of technical products and relaying that understanding through appealing and vibrant language and images. She holds a B.A. in Philosophy from the University of California, Berkeley. To contact Maile, visit her on LinkedIn.

StrongDM logo
💙 this post?
Then get all that StrongDM goodness, right in your inbox.

You May Also Like

StrongDM FAQs: Answering the Most Common Questions
StrongDM FAQs: Answering Your Most Common Questions
Managing secure access to infrastructure shouldn’t be a headache—but for most organizations, it is. That’s where StrongDM comes in. We replace clunky, outdated access solutions with a frictionless, Zero Trust approach that actually makes life easier for IT, DevOps, and security teams. In this FAQ blog post, we’re cutting through the noise to answer the most common questions about StrongDM—what it is, how it works, and why it’s the go-to platform for secure, scalable access.
How to Delete a Postgres User (dropuser & DROP USER)
How to Delete a Postgres User (dropuser & DROP USER)
When working with or administering a database, you'll need to delete, remove, or drop users at some point. This might seem like a routine task, but dropping unnecessary or old users is crucial for maintaining database security. This helps remove access points for malicious actors — both in-house and external — so only authorized individuals can perform operations on it.
The State of Zero Trust Security in the Cloud Report by StrongDM
As enterprises increasingly migrate workloads to the cloud, security strategies must adapt to meet evolving threats. Zero Trust, emphasizing identity verification and least privilege access, has become a critical framework for securing cloud environments. StrongDM’s recent survey of 600 cybersecurity professionals sheds light on the progress and challenges organizations face in adopting Zero Trust for the cloud.
15 Cybersecurity Regulations for Financial Services
15 Cybersecurity Regulations for Financial Services in 2025
In this guide, we’ll cover the 15 most important cybersecurity regulations for financial services providers. We’ll show exactly which ones—from GDPR and PCI DSS to MAS TRM, CBEST, and others—apply to your organization, and explain, in plain in English, what they are, how they impact your business, and how you can initiate a path for compliance.
HIPAA Multi-Factor Authentication (MFA) Requirements
HIPAA Multi-Factor Authentication (MFA) Requirements in 2025
The HIPAA Multi-Factor Authentication (MFA) requirement is a security measure that requires users to verify their identity using at least two different factors—such as something they know (a password), something they have (a smartphone or token), or something they are (a fingerprint)—to access systems containing electronic Protected Health Information (ePHI). This additional layer of security is designed to protect sensitive healthcare data from unauthorized access, even if one credential is compromised, and helps organizations comply with the HIPAA Security Rule.