How Data Breaches Happen: From Phishing to Credential Stuffing

A company’s security team discovers unusual activity in their servers at 3 AM. Files are being deleted at scale. The attackers have already spent weeks inside the network, escalating privileges and moving laterally across the infrastructure. By the time the breach is detected, thousands of customer records are already heading toward the dark web. This scenario plays out across dozens of organizations every month, each following patterns that have become predictable in their machinery.

Data breaches rarely happen through dramatic “zero-day” exploits or Matrix-style hacking. Instead, they follow a handful of well-understood techniques that work because human and organizational vulnerabilities remain constant. Understanding how breaches actually occur—the pathways attackers take, the mistakes companies make—is the first step toward practical defense.

The Scale and Cost of Breaches

The infrastructure for data breaches has become industrialized. According to research from IBM’s 2024 data breach report, the average cost of a data breach globally reached $4.88 million, with healthcare and financial sectors bearing even higher costs—reaching $10.93 million and $6.08 million respectively in those industries. These figures matter because they shape corporate security decisions: a $5 million breach at a mid-sized company translates to serious board room pressure and, often, layoffs.

For Brazilian companies, the impact is compounded by LGPD (Lei Geral de Proteção de Dados), the Brazilian data protection law that went into full effect in 2020. Violations carry fines up to 2% of annual revenue or 50 million reais, whichever is higher. That legal backdrop means breach response in Brazil isn’t just about reputation—it’s about regulatory compliance and potential financial penalties that can threaten a company’s viability.

Phishing: When the Doorman Is Your Attacker

Read also: Inside Smartphone Chip Design and Manufacturing · From Pre-Seed to Series D: How Startup Funding Really Works · How Big Tech Companies Make Money: Revenue Models Explained · How Self-Driving Cars Perceive the Road: Sensors, Processing, Limits

Phishing remains the most reliable entry point into organizations. It works because it doesn’t require technical sophistication on the attacker’s side—just an understanding of human psychology.

The mechanics are straightforward: An attacker sends an email that appears to come from a trusted source—often impersonating IT support, a vendor, or an executive—requesting credentials or directing the recipient to click a link. The link leads to a fake login page that captures credentials, or a malicious attachment that installs malware once opened. A 2024 Verizon data breach investigation report found that phishing was present in 36% of breaches overall, and in 80% of breaches involving ransomware.

Spear Phishing and Personalization

Spear phishing adds targeting: the attacker researches specific employees, learns their manager’s name, the company’s tech stack, recent announcements, and crafts an email so personalized it’s difficult to distinguish from legitimate internal communication. An employee at a São Paulo fintech might receive an email appearing to come from their CEO, mentioning the company’s recent acquisition, with an urgent request to click a link to “verify account details.” The email uses the company’s actual logo and color scheme. The employee clicks. Within minutes, their email credentials are compromised, and the attacker begins mining the mailbox for further targets, payment information, and sensitive business data.

Credential Stuffing and the Password Reuse Epidemic

When users reuse passwords across services—a Gmail password that’s also used for corporate VPN, online banking, and the company’s internal tools—breaches compound. A breach at a small service exposes hundreds of thousands of credentials. Attackers use automation to test those credentials against every major platform: Gmail, LinkedIn, Facebook, corporate login portals, cloud services.

This technique, called credential stuffing, doesn’t require the attacker to crack passwords. It simply leverages the fact that many people use variations of the same password across sites. If someone’s Netflix password is in a leaked database, attackers will automatically try that username and password combination against Microsoft 365, AWS, Slack, GitHub, and dozens of other services. Success rates can exceed 5% depending on the service—high enough to make the attack worthwhile at scale.

A Brazilian e-commerce company suffered a breach in 2023 that exposed customer login details. That same data was immediately used for credential stuffing attacks against Brazilian bank portals and payment services. Customers who had reused credentials found their bank accounts accessed and drained before they even knew about the original breach.

Unpatched Software: The Open Door

Vulnerabilities in software are discovered, disclosed, and patched all the time. Yet many organizations fail to apply patches quickly, or at all. This creates windows of opportunity for attackers.

Critical Vulnerabilities and Time Windows

Critical vulnerabilities in widely used software can affect millions of systems. When a vulnerability is publicly disclosed, attackers have a known window: the time between disclosure and when most organizations have patched. In 2023, attackers exploited known vulnerabilities in VMware software to gain initial access to networks, then installed persistence mechanisms and moved laterally. Organizations that hadn’t patched within weeks of the disclosure were compromised.

Ransomware groups particularly target organizations known to lag on patching. They scan the internet for systems running outdated versions of common software—older versions of Remote Desktop Protocol servers, unpatched SQL databases, or older web servers—and attempt to access them. Once inside, they install malware that encrypts files and demands ransom for the decryption key.

Supply Chain Attacks: Trusting the Wrong Partner

The weakest link in your security isn’t always inside your own organization—it’s often a third-party vendor or contractor with access to your systems.

The SolarWinds Precedent

SolarWinds exemplifies this danger. In 2020, attackers compromised SolarWinds’ build systems and inserted malicious code into routine software updates. Customers who installed the update—including U.S. federal agencies, major banks, and technology companies—unknowingly installed a backdoor. The attackers maintained access for months, exfiltrating sensitive data across multiple organizations.

Supply chain attacks don’t require compromising the vendor’s core product. They can target:

• Software build systems and package repositories
• Contractors and consultants with network access
• Cloud providers’ security and updates
• Third-party libraries bundled into applications

A Brazilian company using a popular e-commerce platform might be affected by a vulnerability in a third-party payment processor that connects to that platform. The payment processor is compromised, but the breach affects all their customers using that payment method across multiple e-commerce sites.

Insider Threats and Misconfigurations

Not all breaches involve external attackers. Insiders with legitimate access—disgruntled employees, contractors, or vendors—can exfiltrate data directly. A database administrator angry about a denied promotion downloads customer records before leaving. A contractor accidentally shares a database password in a public GitHub repository. A cloud storage bucket is configured to allow public read access, accidentally exposing thousands of files.

The Cloud Configuration Problem

Misconfiguration is particularly common in cloud environments. Amazon Web Services S3 buckets, Google Cloud Storage buckets, or Azure Blob Storage containers are sometimes left accessible to anyone on the internet. Security researchers regularly scan for these and report them, but the vulnerabilities often go unfixed for weeks.

Detection, Response, and the Cost of Delay

Organizations that detect breaches quickly minimize damage. The difference between detecting a breach after one day versus after 200 days costs roughly $1 million in additional damage, according to IBM’s analysis. Detection time in Brazil averages around 300 days, nearly double the global average, partly due to less mature security infrastructure in many companies.

Detection methods include:

• Security information and event management (SIEM) systems that aggregate logs
• Endpoint detection and response (EDR) tools that monitor unusual activity on individual computers and servers
• Threat intelligence feeds that flag known malicious IP addresses and domains
• Incident response playbooks that document what to do when a breach is suspected

Response time matters legally in Brazil. LGPD requires organizations to notify regulators of breaches without undue delay, and to notify affected individuals. The sooner a company can contain the breach, the fewer people are affected, and the lower the regulatory and financial penalty.