What the breaches actually teach us
We analyzed every major breach from 2023–2025. The pattern is clear: data exfiltration happens before encryption, most breaches go undetected for weeks, and automated security tooling almost never catches it. These are the facts that shaped VaultGuardian.
Out of the 8 major breaches we analyzed, only 2 involved encryption.
In every case, exfiltration happened first or was the entire attack. Detection almost never came from automated security tooling.
2023–2025 breach post-mortems
Change Healthcare
February 2024EXFIL → ENCRYPTAn ALPHV/BlackCat affiliate used stolen credentials to access a Citrix portal that lacked MFA. They moved laterally for 9 days, exfiltrating 6 TB of data including PHI, SSNs, and medical records for 192.7 million individuals. Ransomware was deployed after the data was already gone. UHG paid $22M in ransom. The affiliate kept the data anyway and re-extorted via RansomHub.
9 days
192.7M individuals
$2.5B
Ransomware deployment (reactive)
Stolen credentials, no MFA on Citrix portal
6 TB via unknown channels over 9 days
MGM Resorts
September 2023EXFIL → ENCRYPTScattered Spider called the IT help desk, impersonated an employee using LinkedIn research, and got Okta Super Admin + Azure Global Admin in a 10-minute phone call. They set up a rogue identity provider for persistent access, dumped domain credentials, then exfiltrated ~6 TB via Mega.nz and Dropbox before deploying BlackCat ransomware to 100+ ESXi hypervisors.
3 days
~6 TB customer data
$100M
Internal security team
Vishing (social engineering) of IT help desk
Mega.nz, Dropbox, Azure Data Factory, CommVault
Snowflake Campaign
April 2024EXFIL ONLYUNC5537 systematically compromised ~165 Snowflake customer instances using credentials harvested by infostealer malware — some dating back to 2020. No MFA, no credential rotation, no network allow lists. Ticketmaster (560M records), AT&T (109M call logs), Santander, LendingTree, and more. No encryption was deployed in any case.
Weeks–months per victim
560M (Ticketmaster) + 109M (AT&T) + more
669M+ records
Mandiant investigation after data appeared for sale
Infostealer-harvested credentials (VIDAR, REDLINE, etc.)
SQL staging commands, MEGA cloud storage
MOVEit / Cl0p
May 2023EXFIL ONLYCl0p exploited CVE-2023-34362 (SQL injection → RCE) in Progress Software's MOVEit Transfer at mass scale. Evidence shows they tested the exploit for 2 years before deploying it. They used MOVEit's own file transfer functionality to exfiltrate data in ~95% of cases. No lateral movement, no ransomware. Pure smash-and-grab exfiltration at industrial scale.
Varies — mass exploitation over days
58 million individuals across 3,000+ orgs
58M+ individuals
Vendor advisory triggered investigations
Zero-day SQL injection (CVE-2023-34362)
MOVEit's own file transfer functionality
Caesars Entertainment
August 2023EXFIL ONLYSame Scattered Spider group that hit MGM, but a week earlier. Social engineering of an outsourced IT vendor — no identity verification procedures. 20-day dwell time. Complete Caesars Rewards loyalty database exfiltrated (65M members, SSNs, driver's licenses). No ransomware deployed. Caesars negotiated from $30M to $15M and paid.
20 days
65 million loyalty members
$15M ransom
Unknown
Social engineering of outsourced IT vendor
Cloud storage exfiltration
Microsoft / Midnight Blizzard
November 2023EXFIL ONLYRussian SVR (APT29) password-sprayed a legacy test tenant account that lacked MFA. Used residential proxies to appear legitimate. Pivoted via a legacy OAuth app with excessive permissions to create a Global Admin in the production tenant. Granted themselves full_access_as_app to all mailboxes. Read senior leadership, cybersecurity, and legal team email for 7 weeks. Also accessed source code repositories.
7 weeks
Senior leadership mailboxes
Source code + strategic intel
EWS audit log analysis
Password spray on test tenant, no MFA
Exchange Web Services API
Okta Support System
September 2023EXFIL ONLYAn Okta employee synced work credentials to a personal Google account via Chrome Sync. Attacker compromised the personal account, accessed Okta's support system, downloaded HAR files containing active session tokens, and hijacked sessions of 5 customers including 1Password, BeyondTrust, and Cloudflare. A 14-day investigation gap occurred because file-level access logs used different record IDs than case-level logs.
20 days
Session tokens for 5 major customers
5 customer compromises
Customer (BeyondTrust) reported suspicious activity
Personal account compromise via Chrome Sync
HAR file downloads from support system
Salt Typhoon
2023–2024EXFIL ONLYChinese MSS-affiliated group compromised 9+ major US telecom providers and orgs in 80+ countries. Accessed CALEA lawful intercept/wiretap systems. Used edge device exploits (Cisco, Ivanti, Palo Alto, Fortinet) and custom in-memory malware. Deployed Linux containers on Cisco routers to process data locally. Call metadata for 1M+ users concentrated in Washington D.C.
3+ years
1M+ users call/text metadata + political figures
National security breach
US government intelligence
Edge device zero-days + stolen credentials
GRE tunneling, on-box data processing
When did they find out?
Not one was caught by automated security tooling.
The ransomware kill chain
Exfiltration is Phase 4. Encryption is Phase 5. Catching Phase 4 prevents Phase 5.
Initial Access
Day 0Stolen credentials, phishing, or zero-day exploit.
Lateral Movement
Days 1–14Reconnaissance, privilege escalation, network mapping, persistence establishment.
Data Staging
Days 7–20Files identified, compressed, archived, staged for extraction.
Exfiltration
⚡ VAULTGUARDIAN TRIGGERSUpload begins. The loudest moment in the attack. The first time most companies find out they've been breached.
Connection killed. Alert fired. Response clock starts.
Your team knows the server is compromised before the attacker can encrypt a single file.
Encryption
✓ PREVENTEDRansomware deploys. Files encrypted. By now the data is already gone — unless exfiltration was stopped.
The data speaks for itself
Exfiltration is the attack. VaultGuardian is the answer.