Learn / Attack archive / Lesson 20
Why breaches happen — the six patterns
The start of the attack archive. Almost every recent breach reuses one of six gaps, and knowing the six is worth more than knowing any single attack.
Last updated: 2026-09-23
What it is
This section of the course is an archive of real attacks, most of them from 2023 to 2026. Each lesson takes one kind of attack, walks through the incidents that made the news, and explains the gap that let the attacker in.
Read enough breach reports and they start to repeat. The tools change every year. The gaps behind them barely change at all. Nearly every incident in this archive fits one of six:
| Pattern | The gap | Lessons |
|---|---|---|
| 1. Someone else's code | You run code you did not write and did not check | Poisoned packages, framework flaws |
| 2. A password is the only lock | A stolen or reused password opens the door | Stolen logins, phishing that beats MFA |
| 3. People can be talked into it | A helpful human resets access for the wrong person | Help desks and admin consoles |
| 4. A token outlives its purpose | A session or API token is stolen and still works | Stolen tokens and connected apps |
| 5. The front door is unpatched | An internet-facing box has a known hole | Edge devices and mass exploitation |
| 6. Nobody locked it | A bucket, database or admin panel was open by default | Open buckets and default passwords |
Two newer forces now sit on top of all six: AI agents that find and chain these gaps at machine speed, and floods big enough to knock a site offline without breaking in at all. Each has its own lesson.
Why it is a rule
- Change Healthcare, February 2024. One remote-access portal with no multi-factor login. Attackers used a stolen password, spread for nine days, then encrypted the systems that process a large share of US medical claims. About 190 million people were affected and a $22 million ransom was paid. Pattern 2.
- Snowflake customers, mid-2024. Around 165 companies, including Ticketmaster, AT&T and Santander, lost data. Snowflake itself was not broken. The attackers logged in with passwords stolen years earlier by malware on employees' laptops, to accounts with no second factor. Pattern 2.
- Marks and Spencer, April 2025. Attackers phoned the IT help desk, pretended to be staff, and got logins reset. Online orders stopped for weeks and the company put the cost at about £300 million. Pattern 3.
- Axios on npm, 31 March 2026. One of the most downloaded JavaScript libraries shipped two versions that installed a remote-access trojan on every machine that ran
npm install. Pattern 1.
None of these needed a genius. Each needed one gap that nobody had closed.
How to do it
Use the six patterns as a checklist against your own system:
- List the code you run but did not write. Packages, CI actions, browser scripts, vendor appliances. Each one is a door.
- Find every login that is only a password. Staff tools, cloud consoles, the database, the domain registrar.
- Write down who can reset access, and how they check who is asking.
- List every long-lived token. API keys, OAuth grants to third-party apps, CI secrets.
- List every service reachable from the internet and when each was last patched.
- Check that every store of data is private by default.
Then read the lesson for whichever list scared you most.
How we do it here
We review the site against these six patterns rather than against a list of named attacks, because the patterns change far more slowly than the attacks do. The rest of this course covers the specific defences.
Benefits
- Six questions are small enough to ask about every new feature.
- A new attack in the news can be sorted into a pattern in a minute, which tells you whether it applies to you.
- The patterns point at fixes that stop whole families of attacks, not one.
Disadvantages
- Real incidents usually chain two or three patterns, so a clean fix for one is not the end.
- Patterns do not tell you which gap an attacker will pick first. That still takes judgement.
- An archive always describes the past. The next attack may use a gap that has no lesson yet.
Checklist
- You can name every piece of third-party code you run.
- No staff or admin login is password-only.
- Access resets require more than a convincing voice.
- Long-lived tokens are listed, scoped and rotated.
- Internet-facing services are patched within days, not months.
- Every data store is private unless someone chose otherwise.
Sources
- Verizon — Data Breach Investigations Report
- CISA — Known Exploited Vulnerabilities Catalog
- Google Cloud — UNC5537 targets Snowflake customer instances
- CISA — Supply Chain Compromise Impacts Axios npm
- UnitedHealth Group, testimony to the US Senate Finance Committee, May 2024.