In 2024 alone, breaches tied to a single cloud data warehouse provider exposed records belonging to AT&T, Ticketmaster, Santander Bank, and dozens of other organizations that had nothing in common except one shared vendor: Snowflake. That single incident illustrates the uncomfortable truth about modern cybersecurity — breaches at massive, well-funded companies aren’t happening because security teams are lazy or incompetent. They’re happening because the attack surface has grown faster than any organization’s ability to defend it.
The Uncomfortable Math: Attackers Only Need One Way In
Defenders have to secure every laptop, server, API, cloud bucket, and vendor connection, every single day. Attackers just need one mistake. This asymmetry is the single biggest reason breaches persist even at companies spending nine figures a year on security.
The average large enterprise now runs security across a dizzying combination of environments. A 2023 IBM study found the typical organization uses 45 different security tools from various vendors, and juggling that many dashboards creates blind spots rather than closing them.
- Cloud sprawl: Companies like Capital One and Toyota have had breaches traced to misconfigured cloud storage buckets or improperly secured cloud databases.
- Shadow IT: Employees spin up unauthorized SaaS tools and cloud instances that IT never approved or scanned.
- M&A debt: Every acquisition inherits the acquired company’s outdated systems, unpatched software, and forgotten credentials.
- Remote work sprawl: Home routers, personal devices, and VPN gateways expanded the perimeter overnight after 2020 and never really shrank back.
As former CISA Director Jen Easterly has put it in public remarks, technology has been “sold to us as if it’s ready to use safely out of the box” when in reality it ships with defaults that favor convenience over security.
Third-Party and Supply Chain Risk: One Vendor, Dozens of Victims
Some of the most damaging breaches of the past two years didn’t start with the victim company at all. They started with a vendor those companies trusted to move data, process payroll, or manage software updates.
The MOVEit Disaster
In May 2023, the Russian-speaking ransomware group Cl0p exploited a SQL injection vulnerability (CVE-2023-34362) in Progress Software’s MOVEit Transfer tool, a widely used file-transfer application. Because thousands of organizations used MOVEit to move sensitive files, the single flaw cascaded into one of the largest breach events in history.
Estimates from cybersecurity firm Emsisoft put the number of organizations affected at over 2,700, impacting more than 93 million individuals, including government agencies, universities, and Fortune 500 firms that never used MOVEit directly themselves — their payroll or benefits vendor did.
The Snowflake Fallout
The 2024 Snowflake-linked breaches worked differently but proved the same point. Attackers didn’t hack Snowflake’s core infrastructure; they used credentials stolen via infostealer malware, often harvested years earlier, to log into customer accounts that lacked multi-factor authentication.
| Company | Data Exposed | Root Cause |
|---|---|---|
| AT&T | Call and text records of ~110 million customers | Compromised Snowflake account credentials, no MFA |
| Ticketmaster | Personal data of ~560 million users | Credential-based access to Snowflake instance |
| Santander | Employee and customer data across three countries | Third-party database compromise |
Snowflake itself wasn’t “hacked” in the traditional sense — it enforced whatever authentication settings each customer chose. That’s the crux of supply-chain risk: security is only as strong as the weakest configuration in the chain, and vendors can’t force customers to turn on protections they’ve left optional.
The Human Element Still Wins
Firewalls and encryption mean little when an attacker can simply call an IT help desk and ask for a password reset. That’s exactly how the Scattered Spider group, a loosely organized collective of mostly young, English-speaking hackers, breached both MGM Resorts and Caesars Entertainment in September 2023.
Instead of exploiting code, they used vishing — voice phishing — to impersonate an MGM employee on a call to the company’s IT help desk, convincing staff to reset multi-factor authentication credentials. MGM’s resulting shutdown of casino floor systems, hotel key cards, and slot machines cost the company an estimated $100 million in lost revenue and remediation costs.
Caesars reportedly paid roughly $15 million of a $30 million ransom demand to avoid having stolen loyalty-program data leaked, according to a filing with the SEC.
- Phishing and vishing remain the top initial access method in Verizon’s annual Data Breach Investigations Report, tied to roughly 68% of breaches when including human error and social engineering combined.
- Help desks are a favorite target because resetting an MFA token or password is a routine, low-friction request employees are trained to fulfill quickly.
- Deepfake voice and video tools are making these impersonation attacks harder to detect; a Hong Kong finance worker in 2024 wired $25 million after a video call with deepfaked executives.
Legacy Systems and the Patch Lag Nobody Wants to Talk About
Big companies aren’t running on brand-new architecture. Banks still run COBOL on mainframes from the 1970s and 80s. Hospitals still run Windows 7 on MRI machines because upgrading firmware could void FDA certification.
The 2017 Equifax breach — which exposed Social Security numbers for 147 million Americans — happened because the company failed to patch a known vulnerability in Apache Struts (CVE-2017-5638) for months after a fix was publicly available. That single unpatched web application framework component led to a $700 million settlement.
Patching sounds simple, but in a company with tens of thousands of servers and interdependent legacy applications, applying a patch can break production systems, halt supply chains, or void vendor support agreements.
- A vulnerability is disclosed, often with a proof-of-concept exploit published within days.
- Security teams must test the patch against internal applications before deployment to avoid outages.
- Change-management approval boards, especially in regulated industries like banking and healthcare, can take weeks to sign off.
- Meanwhile, automated scanning tools used by attackers find and exploit the unpatched systems within a median of five days, according to Mandiant’s threat intelligence data.
That gap between disclosure and full remediation — sometimes called “patch lag” — is where most large-scale breaches actually live, not in some exotic zero-day nobody could have anticipated.
Why the Economics Don’t Push Companies to Fix This Fast Enough
Breaches are expensive, but they’re rarely expensive enough, relative to a company’s size, to force fundamental change. IBM’s 2024 Cost of a Data Breach Report put the global average cost of a breach at $4.88 million, up 10% from the year before — but for a company like AT&T with over $122 billion in annual revenue, that’s a rounding error, not an existential threat.
Cyber insurance further blunts the financial pain, even as premiums have climbed. And stock markets have shown remarkably short memories.
Research from Comparitech tracking breached companies found that stock prices on average dip modestly in the days after disclosure but typically recover to pre-breach levels within about six months — meaning Wall Street rarely punishes breached companies long-term.
That creates a perverse incentive structure worth spelling out plainly:
- Prevention is a cost center that shows up on quarterly budgets with no revenue attached, making it an easy target for cuts during belt-tightening.
- Breach response is often reactive and reimbursable through insurance, legal settlements structured over years, and regulatory fines that, outside the EU’s GDPR, are often capped well below the actual cost of a thorough security overhaul.
- Executives are rarely personally penalized, though that’s shifting — the SEC’s 2023 charges against SolarWinds’ CISO for alleged securities fraud related to breach disclosures sent a chill through the industry, even after a federal judge later dismissed most of the claims in 2024.
- Regulatory fines vary wildly; British Airways was initially fined £183 million by the UK’s ICO for its 2018 breach, later reduced to £20 million on appeal — a fraction of what full remediation across the airline’s systems would have cost.
What Actually Moves the Needle
None of this means breaches are unstoppable or that spending more money is pointless. Certain specific, well-documented interventions consistently reduce both the likelihood and severity of breaches.
| Measure | Why It Works |
|---|---|
| Phishing-resistant MFA (FIDO2/security keys) | Blocks credential-stuffing and vishing-based account takeovers like the MGM and Snowflake incidents |
| Network segmentation | Limits lateral movement so one compromised server doesn’t expose the entire network, as happened at Target in 2013 |
| Zero trust architecture | Assumes breach by default, requiring continuous verification instead of trusting anything inside the perimeter |
| Vendor risk management with contractual security requirements | Forces third parties to prove MFA, encryption, and patching standards before data sharing begins |
| Attack surface management tools | Continuously scans for exposed cloud assets and shadow IT before attackers find them |
Google’s internal data on its BeyondCorp zero-trust model, and Microsoft’s public statement that MFA blocks 99.9% of automated account-compromise attacks, both point to the same conclusion: the fixes aren’t mysterious, they’re just organizationally hard to enforce at scale across thousands of employees, contractors, and legacy systems.
The gap isn’t usually a lack of good ideas. It’s the friction of rolling out those ideas everywhere, all at once, without breaking a business that can’t afford downtime.
Conclusion
Data breaches at big companies keep happening because breach prevention has become an infinite game played against opponents who only need one finite win. Every new cloud service, acquired subsidiary, or third-party vendor adds another door that has to be locked, monitored, and re-checked forever — while an attacker like Cl0p or Scattered Spider only has to find the one door left ajar.
The companies that actually reduce their breach risk aren’t the ones spending the most money; they’re the ones that ruthlessly cut down the number of doors in the first place — retiring legacy systems, enforcing MFA without exception, and treating vendor security as seriously as their own. Until “secure by default” becomes the norm rather than an opt-in feature, expect the headlines to keep coming, just with different company names attached.
Frequently Asked Questions
Why don’t companies just spend more money to stop breaches entirely?
Money helps, but it doesn’t eliminate the fundamental asymmetry between attackers and defenders. A company can spend $500 million on security and still get breached if one vendor leaves MFA optional, or one employee is tricked by a convincing phone call — as happened at both Snowflake-linked companies and MGM Resorts.
Are third-party vendors really that big a risk, or is it overstated?
It’s not overstated — Verizon’s 2024 Data Breach Investigations Report found breaches involving third parties nearly doubled year-over-year, and incidents like MOVEit (affecting over 2,700 organizations) and the Snowflake credential breaches (affecting AT&T, Ticketmaster, and others) show how one weak link can cascade across an entire industry.
Does getting breached actually hurt a company’s stock price or reputation long-term?
Usually not much. Studies from firms like Comparitech show stock prices typically recover within about six months, and outside of catastrophic cases like Equifax’s $700 million settlement, most breached companies don’t see lasting revenue impact — which is part of why the financial incentive to overhaul security fast remains weaker than most people assume.
