Identity Breach Report 2026: MFA Bypassed in 25 of 40

SWI's Identity Breach Report 2026 classified 115 identity breaches from 2021 to October 2026. Where MFA status is known it was bypassed in 25 of 40 cases, and in 2025-2026, 20 of 43 breaches abused a path with no login for MFA to protect at all.

In 20 of the 43 identity breaches disclosed in 2025-2026 (46.5%), the attacker abused a path with no interactive login at which MFA could have applied, according to the Identity Breach Report 2026. In 2021-2022 the share was 7 of 33 (21.2%). The report classifies all 115 incidents in Start with Identity's Identity Breach Database, disclosed from January 2021 to October 2026, by access path, MFA status, failed control and blast radius. Where the records say whether MFA protected the abused account, it was bypassed in 25 of 40 cases and missing in 15.

Attackers talk past MFA instead of breaking it

On human accounts, social engineering of a person began 12 of 29 breaches in 2025-2026 (41.4%), up from 7 of 29 in 2023-2024. Stolen, stuffed and sprayed passwords fell from 15 of 29 to 5 of 29. We call this the talk-past attack: the attacker persuades someone to hand over, reset or approve access, so authentication is satisfied rather than defeated.

The 2023 help desk wave (MGM Resorts, Clorox, Caesars and Okta customers) has not repeated. The calls changed their ask. In UNC6040's campaign, callers posing as IT support talked employees into authorizing a modified Data Loader app in Salesforce. Seven of the 13 social engineering incidents in 2025-2026 involved CRM or SaaS data. Push-spam MFA fatigue, behind Uber and Cisco in 2022, has no recorded case since.

MFA was bypassed more often than it was missing

Of the 40 incidents with a known MFA status, 25 (62.5%) record MFA as present and bypassed. In 13 of those, a person handed over or approved access: a phished one-time code, an adversary-in-the-middle proxy, a help desk reset, an OAuth consent grant or an accepted push. Eight more came from a flaw in an identity appliance that skipped the MFA step, such as Citrix Bleed. At Cyberhaven, an employee with Google Advanced Protection never saw an MFA prompt, because a consent grant is not a login. Phishing-resistant MFA closes the phishing and push routes. It does nothing for the other two.

The MFA blind zone is our name for incidents where MFA was not applicable: a service account, API key, token or OAuth app was abused, or a flaw handed out a session without any login. In 2025-2026 that covered 12 machine-identity incidents, including the Shai-Hulud npm worms and the Salesloft Drift tokens, plus 8 human-account incidents on edge appliances such as FortiGate, Ivanti Connect Secure and BeyondTrust Remote Support. The Identity Vulnerability Report 2026 covers the appliances.

Machine identities are a quarter of breaches and rising

Non-human identities were the abused identity in 29 of 115 breaches (25.2%): 15.2% in 2021-2022, 25.6% in 2023-2024 and 32.6% in 2025-2026. Seven of the 15 nation-state incidents in the database used one. These breaches are also hard to size, because 26 of the 29 report no count of affected people. The problem of credentials nobody owns is now showing up in breach records.

One compromise, many victims

19 of 115 incidents (16.5%) were fan-out breaches, where one compromised identity at a provider reached many customer organizations, and 10 of them were disclosed in 2025-2026. Examples include Okta's 2023 support system breach (134 customers' files accessed), Gainsight (more than 200 potentially affected Salesforce instances) and the ConnectWise Cloud Backup app credential (162 tenants confirmed). Snowflake does not count: no Snowflake system was compromised. Each of about 165 customer accounts was breached separately, without MFA. A fan-out breach needs the provider to revoke; a platform campaign needs every tenant to enforce MFA.

Where the damage and the penalties land

Among the 24 incidents that count affected people or consumer accounts, the 10 with MFA absent hold 72.3% of 445.8 million notifications. Only 10 of 115 records carry a disclosed dollar figure, and Change Healthcare's $3.067 billion is 96.8% of company-reported cost. Regulators lag: 20 of 115 incidents have a regulatory or legal outcome, and none of the 43 from 2025-2026 has one yet. Missing MFA drew an outcome in 6 of 15 cases. The fines against 23andMe and PayPal both cite it.

What to do with it

The report ranks ten identity controls by how many database incidents each addresses. Phishing-resistant MFA on every human login comes first at 40 of 115. An owned inventory of non-human identities with short-lived credentials is second at 30, and the leader in 2025-2026. Brokered third-party access is third at 24. Together the top three address 77 of 115 incidents. If your next quarter allows one project, the 2025-2026 data points at machine identities rather than another MFA rollout. Our earlier analysis of why the help desk is the perimeter covers control nine.

How we did it

Every record cites primary sources (234 in total) and was verified on October 31, 2026. A script prints every figure in the report, and classifications that are not record fields, such as fan-out breaches, are explicit lists with a reason per incident. The set is curated, so it measures what is known, not all breaches, and the 2025-2026 records have less complete attribution, victim counts and regulatory outcomes.

Use the data: download the database as CSV or JSON, and the report's statistics file. All are free to reuse under CC BY 4.0 with attribution to Start with Identity and a link to the report.

Update, November 5, 2026: The database now holds 120 incidents after five October and November additions. The MFA blind zone share for 2025-2026 is 22 of 48 (45.8%), and the top three controls address 79 of 120 incidents. Current figures are in the report, which keeps its finding numbers stable.

Update, November 5, 2026 (later): We added three more records: McKesson, where McKesson confirmed that employee corporate accounts were targeted and data was taken from third-party applications (the vishing and Okta route is the attackers' unverified claim), DigiCert, where a self-registered account outside MFA read archived validation records, and Data Cymru, where ransomware came in through a 12-year-old test account with the password Password1. The database now holds 123 incidents. In 2025-2026 the MFA blind zone is 22 of 50 (44%) and the talk-past share is 13 of 34 human-account breaches (38.2%); MFA was bypassed in 25 of the 41 incidents with a known MFA status, and the top three controls address 79 of 123.