Example Company, Inc.

Impact

With a valid employee credential, an attacker can reach services without going through any network defense.

Recommendation

• Rotate the password of the affected accounts and revoke active sessions.
• Enable MFA on every service the account can access.
• Review the user's device: the source is usually an infostealer on the endpoint.

Evidence

dataset : breach-corpus (infostealer record)
account : a***@empresa-ejemplo.example
date    : matches the reported infection window
password: [redacted in this report]

Validation

Verified: the dataset record matches the domain and the date. No service access was attempted.

Impact

Backups can hold customer data and application secrets. Anyone on the Internet can list and download them.

Recommendation

• Block public access at the account level (S3 Block Public Access).
• Review access logs to learn whether someone else downloaded objects.
• Rotate any secret that lived in those backups.

Evidence

$ curl -s https://backups-example.s3.amazonaws.com/ | head
<ListBucketResult>
  <Name>backups-example</Name>
  <Contents><Key>db/2026-09-30.sql.gz</Key>...
(public listing; no object was downloaded)

Validation

Verified: the listing is visible without authentication. No content was downloaded.

Impact

A role with admin permissions widens the damage of any compromised credential: the attacker inherits control of the account.

Recommendation

• Replace the policy with least-privilege permissions for deployments.
• Separate the deployment role from the runtime role.
• Enable alerts for unusual use of the role.

Evidence

{
  "RoleName": "app-deploy",
  "Statement": [{ "Effect": "Allow", "Action": "*", "Resource": "*" }]
}

Validation

Verified: policy review with the read-only access agreed in the scope.

Impact

Old TLS protocols have known weaknesses and may fail compliance requirements.

Recommendation

• Disable TLS 1.0 and 1.1; allow only TLS 1.2 and 1.3.
• Check that no legitimate client depends on the old protocol.

Evidence

$ openssl s_client -connect portal.empresa-ejemplo.example:443 -tls1
Protocol  : TLSv1
Cipher    : ECDHE-RSA-AES256-SHA
Verify return code: 0 (ok)

Validation

Verified: the server accepted the handshake over TLS 1.0.

Impact

With SPF in softfail, a spoofed email using the domain can still reach the inbox.

Recommendation

• Move SPF to -all once DMARC is on quarantine or reject.
• Publish DKIM for every legitimate sender.

Evidence

$ dig +short TXT empresa-ejemplo.example
"v=spf1 include:_spf.vendor.example ~all"

Validation

Verified: the public DNS record confirms it.