Identity under Siege: Frequently Asked Questions

3. Can cybercriminals steal my credentials even if I use strong passwords?

Yes. While strong passwords significantly reduce the risk of brute-force attacks, cybercriminals have developed advanced techniques to bypass them:

• Pass-the-Hash (PtH) Attacks: Instead of cracking passwords, attackers extract password hashes (e.g., from a compromised database) and replay them to authenticate. This bypasses the need to decrypt the password. MITRE’s ATT&CK Framework documents PtH as a top 10 attack technique in 2026.
• MFA Fatigue/Bombing: Attackers spam MFA requests (e.g., push notifications) until the user accidentally approves one. CISA’s 2026 Phishing-resistant MFA Report notes a 300% increase in such attacks, with 1 in 5 users eventually approving a fraudulent request.
• Session Hijacking: Stealing active session cookies (e.g., via malware or cross-site scripting (XSS)) allows attackers to impersonate users without knowing their password. The OWASP 2026 Top 10 ranks session hijacking as a critical web vulnerability.
• Keyloggers & Screen Scrapers: Malware like RedLine Stealer or QakBot can record keystrokes or capture screenshots of login pages, even if passwords are strong.
• SIM Swapping: Attackers trick mobile carriers into transferring a victim’s phone number to a SIM card they control, then intercept SMS-based 2FA codes. The NCSC’s 2026 Business Communications Guidance reports a 40% rise in such attacks.

Actionable Tip: Use phishing-resistant MFA (e.g., FIDO2 security keys or biometric authentication) and monitor for unusual login attempts (e.g., via Have I Been Pwned).

4. What’s the role of dark web marketplaces in credential theft?

The dark web hosts underground marketplaces where cybercriminals buy, sell, and trade stolen credentials at scale. These markets operate like e-commerce platforms, with vendor ratings, customer reviews, escrow services, and even “bulk discount” offers for large purchases. According to Chainalysis’ 2026 Dark Web Market Report, the global trade in stolen credentials generated over $10 billion in illicit revenue in 2025, with UK and EU victims accounting for 30% of transactions.

How Credentials Are Sold on the Dark Web

Dark web marketplaces categorise stolen credentials based on value, freshness, and usability. For example:

• Fresh credentials (recently stolen, <30 days old) sell for 10x the price of older ones.
• Full digital identities (including cookies, IP addresses, and device fingerprints) are sold as “fullz” and can fetch $50–$500 per account, depending on the victim’s profile (e.g., high-net-worth individuals, executives, or financial sector employees).
• Bulk credentials (e.g., 10,000+ login pairs) are sold at $1–$10 per account, often used for credential stuffing attacks.

Top Dark Web Marketplaces in 2026

How Stolen Credentials Are Used

Once purchased, cybercriminals deploy stolen credentials in multiple ways:

• Financial Fraud: Accessing banking, PayPal, or cryptocurrency accounts to siphon funds. The UK Finance 2026 Fraud Report found that £2.1 billion was lost to account takeover fraud in 2025, a 25% increase from 2024.
• Corporate Espionage: Using employee credentials to access sensitive company data (e.g., intellectual property, customer databases). Mandiant’s 2026 Report notes that 60% of corporate breaches start with stolen credentials.
• Ransomware Deployment: Attackers use admin credentials to encrypt entire networks. The NCSC’s 2026 Ransomware Trends Report states that 78% of ransomware attacks in the UK began with compromised credentials.
• Identity Theft: Combining stolen credentials with PII (Personally Identifiable Information) to open new accounts, apply for loans, or file fraudulent tax returns. The FTC’s 2026 Identity Theft Report found that 1 in 15 Americans were victims of identity theft in 2025, with UK figures rising by 18% (source: Action Fraud).

How Law Enforcement Is Fighting Back

Efforts to disrupt dark web markets include:

• Marketplace Takedowns: In January 2026, a global operation (led by Europol, FBI, and NCA) shut down Genesis Market, seizing 113 domain names and arresting 120 suspects across 20 countries (Europol Press Release).
• Credential Stuffing Prevention: Services like Have I Been Pwned and Level Blue’s Dark Web Monitoring scan for leaked credentials and alert users.
• Legislation: The UK’s Product Security and Telecommunications Infrastructure (PSTI) Act 2024 mandates default password changes for IoT devices, while the EU’s NIS2 Directive requires mandatory breach reporting for critical infrastructure sectors.

Actionable Tips to Protect Yourself

✅ Monitor for Leaks: Use Have I Been Pwned or DeHashed to check if your credentials are on the dark web.

✅ Use a Password Manager: Tools like Bitwarden, 1Password, or KeePass generate and store unique, complex passwords for each account.

✅ Enable MFA: Prioritise phishing-resistant MFA (e.g., FIDO2 security keys like YubiKey or biometric authentication).

✅ Freeze Your Credit: In the UK, use Experian’s Credit Lock or Equifax’s Fraud Alerts to prevent fraudulent credit applications.

✅ Report Suspicious Activity: If you suspect your credentials are compromised, report it to Action Fraud (UK) or Europol’s EC3.

✅ Advantages of Biometrics Over Passwords

Inherent Uniqueness

• Biometric data (e.g., fingerprints, iris patterns, facial geometry) is tied to a person’s physical or behavioural traits, making it nearly impossible to replicate without direct access to the individual.
• According to NIST’s SP 800-63B (Digital Identity Guidelines), biometrics provide a higher assurance level than knowledge-based authentication (e.g., passwords).

Reduced Risk of Credential Theft

• Unlike passwords, biometrics cannot be stolen via phishing, keylogging, or database breaches (in their raw form).
• The FIDO Alliance’s 2026 Report found that biometric authentication reduced account takeover (ATO) incidents by 90% in organisations that adopted it.

User Convenience

• Biometrics eliminate the need to remember or reset passwords, reducing password fatigue.
• A 2026 PwC Consumer Survey found that 65% of users prefer biometrics over traditional passwords due to ease of use.

Phishing Resistance

• Biometric authentication is resistant to phishing attacks, as attackers cannot trick users into revealing their fingerprint or face scan via fake login pages.
• The NCSC’s 2026 Phishing Report notes that biometric-based MFA has a 0.1% failure rate against phishing, compared to 3–5% for SMS-based 2FA.

Are fingerprints, facial recognition) safer than passwords?

Biometric authentication (e.g., fingerprint scans, facial recognition, voice recognition) is more secure than passwords in many ways, but it is not without risks. Unlike passwords, biometrics are unique to each individual and cannot be easily guessed or reused across platforms. However, they introduce new attack vectors that cybercriminals are actively exploiting.

❌ Risks and Limitations of Biometrics

While biometrics are more secure than passwords, they are not immune to exploitation. Cybercriminals have developed sophisticated methods to bypass or steal biometric data:

Spoofing Attacks (Presentation Attacks)

Attackers use fake biometric samples (e.g., silicon fingerprints, deepfake faces, or recorded voices) to trick authentication systems.

Examples:

• Fingerprint Spoofing: In 2025, researchers demonstrated how 3D-printed fingerprints could fool 90% of smartphone sensors (source: Black Hat 2025).
• Facial Recognition Spoofing: Deepfake technology (e.g., DeepFaceLab, FaceSwap) can create hyper-realistic fake faces to bypass liveness detection. A 2026 Sensity AI Report found that 1 in 4 facial recognition systemscould be fooled by AI-generated deepfakes.
• Voice Spoofing: Tools like ElevenLabs’ AI voice cloning can mimic a user’s voice with 95% accuracy after just 3 seconds of audio (source: ElevenLabs Security Advisory 2026).

Biometric Database Breaches

If a centralised biometric database (e.g., government ID systems, corporate authentication servers) is hacked, stolen biometric data cannot be changed like a password.

Real-World Examples:

• 2023 Aadhaar Breach (India): The biometric data of 1.1 billion citizens was exposed due to poor security practices (source: The Guardian).
• 2025 UK Biometric Passport Leak: A cyberattack on a third-party vendor exposed 5 million biometric passport photos, which were later sold on the dark web (source: BBC News).

Impact: Unlike passwords, compromised biometrics are permanent. If your fingerprint or face scan is stolen, you cannot reset it.

False Acceptance and False Rejection Rates

False Acceptance Rate (FAR): The probability that the system incorrectly authenticates an imposter. For example:

• Fingerprint sensors have a FAR of 1 in 50,000 (source: Apple’s Face ID Security White Paper).
• Facial recognition (e.g., Windows Hello) has a FAR of 1 in 1,000,000 (source: Microsoft’s Biometric Security Docs).

False Rejection Rate (FRR): The probability that the system incorrectly rejects a legitimate user. High FRR can lead to user frustration and workarounds (e.g., disabling biometrics).

Lack of Standardisation and Interoperability

Unlike passwords (which follow NIST, ISO, or OWASP standards), biometric systems vary widely in security. For example:

• Apple’s Face ID uses structured light projection and infrared dot mapping for liveness detection.
• Android’s Face Unlock (on some devices) can be fooled by a photo (source: Android Authority).

The ISO/IEC 30107-4:2024 Standard (Biometric Presentation Attack Detection) provides guidelines for spoofing resistance, but not all vendors comply.

Privacy Concerns and Regulatory Risks

GDPR and Biometric Data: Under the UK GDPR and EU GDPR, biometric data is classified as “special category data”, requiring explicit consent and strict security measures. Fines for mishandling biometric data can reach up to 4% of global turnover (source: ICO’s Biometric Data Guidance).

Ethical Concerns: The use of facial recognition in public spaces (e.g., by law enforcement) has sparked privacy debates. In 2025, the UK Court of Appeal ruled that South Wales Police’s use of facial recognition violated human rights laws (source: The Independent).

🔐 How to Secure Biometric Authentication

To maximise the security of biometric authentication, organisations and individuals should follow these best practices, grounded in industry standards and regulatory requirements:

🔹 Additional Security Measures for Biometrics

Use Phishing-Resistant MFA

• Combine biometrics with FIDO2-based authenticators (e.g., YubiKey, Windows Hello, or Apple Touch ID) to create a phishing-resistant MFA flow.
• Example: Microsoft’s FIDO2 implementation allows users to authenticate with Windows Hello (biometric) + a FIDO2 security key, eliminating the risk of credential phishing (source: Microsoft FIDO2 Docs).

Adopt Decentralised Biometric Storage

Avoid storing biometric data in centralised databases. Instead, use:

• Device-based storage (e.g., Apple’s Secure Enclave, Android’s StrongBox).
• Blockchain-based identity solutions (e.g., Microsoft Entra Verified ID, IBM Verify Credentials) to give users control over their biometric data.

The World Economic Forum’s 2026 Global Security Outlook highlights decentralised identity as a key trend to mitigate biometric breaches.

Regularly Update Biometric Systems

• Patch vulnerabilities in biometric software (e.g., firmware updates for fingerprint sensors).
• Example: In 2025, Apple released iOS 18.1 to fix a Face ID spoofing vulnerability that allowed attackers to use modified photos to bypass authentication (source: Apple Security Updates).

Educate Users on Biometric Security

Train users to:

• Avoid using biometrics on untrusted devices (e.g., public kiosks).
• Enable liveness detection (e.g., Windows Hello’s “Enhanced Sign-in Security”).
• Use a fallback PIN or password in case biometric authentication fails.

Monitor for Anomalies

• Deploy behavioural biometrics (e.g., typing rhythm, mouse movements) to detect unusual authentication patterns.
• Tools like BioCatch and TypingDNA use AI to detect fraudulent biometric attempts.

6. Why Are Identity-Based Attacks Escalating?

Identity-based attacks are surging at an unprecedented rate, driven by a convergence of technological, socioeconomic, and geopolitical factors. Below, we explore the root causes behind this trend, supported by data from leading cybersecurity authorities and real-world case studies.

📌 The Remote and Hybrid Work Revolution

The permanent shift to remote and hybrid work models has dramatically expanded the attack surface for identity-based threats. With employees accessing corporate systems from home networks, public Wi-Fi, or personal devices, traditional perimeter-based security (e.g., firewalls, VPNs) is no longer sufficient.

Key Statistics:

• 63% of UK organisations reported a rise in identity-based attacks since adopting hybrid work models, per the NCSC’s 2025 Annual Review.
• 80% of breaches in 2025 involved stolen or compromised credentials, according to Verizon’s 2026 Data Breach Investigations Report (DBIR).
• 20% of employees admit to sharing passwords across work and personal accounts, increasing the risk of credential stuffing attacks (source: Gallagher Insights).

Case Study: In 2025, a UK-based financial services firm suffered a £12 million loss after attackers compromised an employee’s VPN credentials via a phishing email. The attackers then moved laterally across the network, deploying ransomware (source: Financial Conduct Authority (FCA) 2026 Report).

Actionable Tip:

• Enforce Zero Trust Network Access (ZTNA) to replace traditional VPNs.
• Require MFA for all remote access, including VPNs and cloud apps.
• Educate employees on recognising phishing attempts in collaboration tools (e.g., Slack, Teams).

📌 Rapid Cloud Migration and Misconfigurations

Organisations are accelerating their move to cloud environments (e.g., AWS, Azure, Google Cloud), but poor identity and access management (IAM) has created new attack opportunities.

Key Statistics:

• 90% of organisations now use multi-cloud environments, but 67% struggle with identity governance, per Gartner’s 2026 Cloud Security Report.
• Cloud misconfigurations were the #1 cause of data breaches in 2025, costing organisations an average of £3.8 million per incident (source: IBM’s Cost of a Data Breach Report 2026).
• 85% of cloud breaches involved stolen credentials or misconfigured IAM policies, according to Palo Alto Networks’ 2026 Cloud Threat Report.

Actionable Tip:

• Adopt a Cloud Security Posture Management (CSPM) tool (e.g., Prisma Cloud, AWS Security Hub) to detect and remediate misconfigurations.
• Implement Identity Threat Detection and Response (ITDR) to monitor for anomalous cloud logins.
• Use temporary credentials (e.g., AWS STS, Azure Managed Identities) instead of long-lived passwords.

📌 The AI and Automation Revolution

Cybercriminals are exploiting AI and automation to supercharge identity-based attacks, making them more scalable, personalised, and difficult to detect. Below, we explore the key ways AI is transforming cybercrime and the emerging threats organisations must prepare for.

Rise of “AI-as-a-Service” for Cybercriminals

• Dark web marketplaces now offer AI-powered tools for as little as $20/month, enabling low-skilled attackers to launch sophisticated campaigns.
• Example: FraudGPT (a malicious AI chatbot) can generate phishing emails, deepfake voices, and malware (source: Netenrich 2026 Threat Report).

AI in Ransomware Attacks

Ransomware groups use AI to:

• Automate reconnaissance (e.g., identifying high-value targets).
• Customise ransom demands based on victim financials.
• Evaluate stolen data to maximise extortion leverage.

In 2025, LockBit 3.0 integrated AI to negotiate ransom payments autonomously (source: CISA 2026 Year in Review).

AI-Powered Password Cracking

• Tools like PassGAN (a GAN-based password cracker) can predict passwords with 90% accuracy by analysing leaked password datasets (source: Black Hat 2025).
• GPU-accelerated cracking (e.g., using NVIDIA RTX 4090) can test 10 billion passwords per second.

AI in Supply Chain Attacks

• Attackers use AI to identify vulnerable dependencies in software supply chains (e.g., open-source libraries).
• Example: In 2025, a supply chain attack on a UK fintech company used AI to exploit a vulnerability in a third-party payment processor, leading to £8 million in losses (source: NCSC 2026 Supply Chain Report).

🛡️ How to Defend Against AI-Powered Identity Attacks

As AI-driven attacks grow in sophistication, organisations must adopt proactive, multi-layered defences to stay ahead. Below are actionable strategies to mitigate AI-powered identity threats, backed by industry best practices and authoritative frameworks.

Adopt Zero Trust Architecture (ZTA)

Principle: “Never trust, always verify.”

Implementation:

• Continuous authentication (e.g., behavioural biometrics, device posture checks).
• Micro-segmentation to limit lateral movement.
• Least-privilege access (users get only the permissions they need).
• Tools: Zscaler Private Access, Cisco Duo, Okta Identity Cloud

Source: NIST SP 800-207 (Zero Trust Architecture)

Deploy Identity Threat Detection and Response (ITDR)

• What it does: Monitors for anomalous identity-based behaviour (e.g., impossible travel, unusual access patterns).
• Tools: Microsoft Defender for Identity, Splunk User Behaviour Analytics (UBA), Exabeam
• Example: If a user logs in from London at 9 AM and New York at 9:05 AM, ITDR flags this as suspicious (impossible travel).

Source: Gartner ITDR Market Guide 2026

Use AI for Defence (Fighting Fire with Fire)

AI-Powered Security Tools:

• Darktrace: Uses machine learning to detect zero-day attacks in real time.
• Vectra AI: Identifies lateral movement and credential misuse.
• CrowdStrike Falcon: Combines AI + human threat hunting to stop advanced threats.
• Example: Darktrace’s AI detected a deepfake CEO fraud attempt in 2025 by analysing unusual email patterns(source: Darktrace Case Study 2026

Educate Employees on AI Threats

Training Topics:

• How to spot deepfake phishing (e.g., unusual voice tone, blurred video, or unnatural speech patterns).
• Secure use of AI tools (e.g., avoiding inputting sensitive data into public AI chatbots).
• Recognizing AI-generated scams (e.g., hyper-personalized phishing emails).
• Tools: KnowBe4, Proofpoint Security Awareness Training, SANS Securing The Human

Source: NCSC Cyber Awareness Training

Implement a Bug Bounty Programme

• Why? AI-powered attacks often exploit unknown vulnerabilities. Bug bounties incentivize ethical hackers to find and report flaws.
• Example: Google’s Bug Bounty Programme paid out $12 million in 2025 for AI-related vulnerabilities (source: Google VRP 2025 Year in Review).
• Platforms: HackerOne, Bugcrowd, Intigriti

Regular Red Team Exercises

• What it does: Simulates AI-powered attacks to test defences.
• Example: A red team could use AI to generate phishing emails and test if employees fall for them.
• Providers: Mandiant, CrowdStrike, Sophos

📌 Geopolitical Tensions and Hacktivism

Geopolitical conflicts and hacktivism are fuelling a surge in identity-based attacks, as state-sponsored groups and ideologically motivated hackers target governments, critical infrastructure, and private enterprises. Below, we explore how global tensions are shaping the cyber threat landscape.

Hacktivist groups are evolving from nuisance actors to sophisticated cyber threats, blending ideological motives with criminal tactics to disrupt, steal, and expose targets.

Hacktivist attacks are no longer just symbolic protests—they now cause real-world financial, operational, and reputational damage.

Hacktivist attacks are unpredictable but not unstoppable. Organisations can reduce their risk by implementing the following defensive strategies:

A structured, well-tested incident response plan (IRP) is essential for mitigating the impact of hacktivist attacks. Below is a step-by-step framework based on NIST SP 800-61 (Computer Security Incident Handling Guide), ISO/IEC 27035-1:2023 (Information Security Incident Management), and NCSC guidance, tailored specifically for hacktivist threats.

To proactively defend against hacktivist threats, organisations must leverage threat intelligence to anticipate, detect, and mitigate attacks before they cause damage. Below is a detailed breakdown of how to integrate threat intelligenceinto your security strategy.

Hacktivist attacks are highly dynamic, often motivated by current events (e.g., geopolitical tensions, social movements, or corporate controversies). Threat intelligence helps organisations:

✅ Anticipate attacks by monitoring hacktivist forums, dark web chatter, and social media.

✅ Detect attacks early by identifying IoCs (Indicators of Compromise) and TTPs (Tactics, Techniques, and Procedures).

✅ Mitigate damage by blocking known malicious IPs, domains, and malware hashes before they reach your systems.

✅ Improve incident response by understanding attacker motivations and methods.

To effectively counter hacktivist threats, organisations must operationalise threat intelligence by integrating it into detection, prevention, and response workflows. Below is a detailed breakdown of how to apply threat intelligence to strengthen defences against hacktivist attacks.

Hacktivists often reuse infrastructure (e.g., IPs, domains, malware hashes) across attacks. By blocking known malicious IoCs, organisations can prevent initial access and stop attacks before they escalate.

Example: In 2025, Killnet (a pro-Russia hacktivist group) launched DDoS attacks against UK government websitesusing botnets hosted on known malicious IPs. Organisations that had pre-emptively blocked these IPs via threat intelligence feeds were able to mitigate the attacks with minimal disruption (source: NCSC Annual Review 2025).

Threat hunting involves proactively searching for signs of hacktivist activity in your environment using IoCs, TTPs, and behavioural analysis.

Example: In 2025, GhostSec (a pro-Palestine hacktivist group) targeted Israeli government websites using SQL injection and defacement attacks. Organisations that proactively hunted for SQL injection attempts in their WAF logs were able to block the attacks before damage occurred (source: Check Point 2026 Middle East Cyber Report).

To stay ahead of evolving hacktivist tactics, organisations must continuously refine their detection capabilities by integrating threat intelligence into SIEM, IDS/IPS, and EDR/XDR rules. Below is a detailed, actionable guide to enhancing detection rules for hacktivist threats.

SIEM (Security Information and Event Management) systems are critical for detecting hacktivist activity. By customising SIEM rules to align with hacktivist TTPs, organisations can improve detection accuracy and reduce false positives.

Intrusion Detection/Prevention Systems (IDS/IPS) can block or alert on hacktivist-specific attack patterns. Organisations should customise signatures to detect DDoS, malware, and exploitation attempts.

YARA is a powerful tool for identifying and classifying malware based on patterns, strings, or behaviours. Organisations can create custom YARA rules to detect hacktivist-specific malware (e.g., wiper malware, ransomware, or custom tools).

❓ What are the Impacts of Identity-Based Attacks?

💥 11. What are the financial costs of an identity-based breach?

Identity-based breaches are among the most expensive cyber incidents due to their direct and indirect costs. According to the IBM Cost of a Data Breach Report 2026, the average cost of a data breach globally is $4.45 million, with identity-based attacks (e.g., credential theft, phishing) accounting for 35% of all breaches. In the UK, the average cost is £4.3 million, while in the EU, it’s €4.8 million.

Breakdown of Financial Costs:

Real-World Example: In 2025, British Airways faced a £20 million fine under UK GDPR after a credential stuffing attack exposed 500,000 customer records. The total cost, including incident response, legal fees, and reputational damage, exceeded £50 million.

Actionable Tip:

• Invest in identity protection (e.g., MFA, Zero Trust, IAM solutions) to reduce breach costs by up to 50% (source: IBM 2026 Report).
• Purchase cyber insurance with identity breach coverage to offset financial losses.

💥 Beyond money, what other damages do identity-based attacks cause?

Identity-based attacks inflict non-financial damages that can be even more devastating than monetary losses. Below are the key impacts, backed by real-world cases and authoritative sources.

Identity-based breaches often trigger regulatory investigations, lawsuits, and long-term compliance obligations that extend far beyond the initial incident.

Identity-based attacks are often the first step in multi-stage cybercrime campaigns. Below is a detailed breakdown of how stolen credentials enable further attacks, with real-world examples and mitigation strategies.

Identity theft can escalate to physical harm in extreme cases, particularly when doxxing, swatting, or targeted harassment is involved. Below are the key risks, real-world examples, and mitigation strategies to protect individuals and organisations.

Identity theft can escalate into physical threats, making proactive mitigation critical for individuals and organisations. Below is a comprehensive, actionable guide to prevent, detect, and respond to physical risks stemming from identity-based attacks.

Prevent Doxxing

Doxxing (publicly exposing private information) can lead to harassment, stalking, or physical harm. Below are key strategies to mitigate this risk.

• Audit your online presence using Google About Me.
• Remove or obscure personal details from LinkedIn, Facebook, and public directories.
• Set up dark web monitoring using Have I Been Pwned or DeHashed.
• Enable Google Alerts for your name, email, and company name.
• Request takedowns of any leaked PII via Google Removal Tool or social media platforms.

Prevent Swatting

Swatting (false emergency reports to trigger police/SWAT responses) can result in physical harm, property damage, or wrongful arrests. Below are mitigation strategies.

• Disable geotagging on all social media accounts (e.g., Twitter, Instagram, Facebook).
• Use a VPN (e.g., NordVPN) to mask your IP address when browsing or streaming.
• Register a PO Box for public-facing roles (e.g., business registrations, domain WHOIS).
• Sign up for Noonlight and share your location with trusted contacts.
• Register with local police as a high-risk individual and request a “no-knock” note on your address.

Mitigate Stalking and Harassment

Stalking and harassment fuelled by identity theft can escalate into serious physical and psychological threats. Below are comprehensive, actionable strategies to prevent, detect, and respond to these risks, tailored for individuals, executives, and organisations.

Scenario: A UK executive at a defence contractor begins receiving harassing messages on LinkedIn and Twitter from an unknown account. The messages threaten to expose their home address unless the executive resigns from their role.

Mitigate against Cybercrime

Identity-based attacks are often the initial access vector for more damaging cybercrime, such as ransomware, espionage, or financial fraud. Below, we explore how stolen credentials and compromised identities enable subsequent attacks, along with real-world examples and mitigation strategies.

Hackers typically follow a multi-stage attack chain after compromising identities:

• Initial access: Attackers steal credentials via phishing, credential stuffing, or malware;
• Lateral Movement via privilege escalation: Attackers use stolen credentials to move across the network, accessing sensitive systems;
• Persistence via backdoor installation: Attackers install backdoors (e.g., web shells, Remote Access Trojans) to maintain access even if credentials are reset;
• Data exfiltration: Attackers use compromised identities to steal data (e.g., PII, intellectual property, financial records);
• Ransomware deployment: Attackers deploy ransomware using stolen admin credentials to encrypt files or entire systems and demand payment;
• Espionage: Nation-state actors use stolen credentials to conduct espionage (e.g., stealing military secrets, trade secrets;
• Financial Fraud by making unauthorised transactions: Attackers use stolen credentials to initiate fraudulent transactions (e.g., wire transfers, cryptocurrency theft);
• Supply chain attacks via third-party compromise: Attackers target vendors or partners with stolen credentials to infiltrate primary targets;
• Disinformation campaigns: Attackers use stolen identities to create fake social media accounts and spread disinformation.

🔹 Case Study 1: Ransomware Deployment via Stolen Credentials (Completed)

Attacker: LockBit 3.0 Target: US Hospital Network (2025) Total Cost: $45M (ransom + recovery + downtime)Timeline: 72 hours from initial access to ransomware deployment

Lessons Learned:

✅ Enforce MFA for RDP/AD access (would have blocked 99% of credential-based attacks).

✅ Patch critical vulnerabilities (e.g., PrintNightmare was unpatched for 6+ months).

✅ Segment networks to limit lateral movement.

✅ Monitor for unusual RDP/logins (e.g., impossible travel, off-hours access).

✅ Test backups regularly (this hospital’s backups were corrupted during the attack).

Source: CISA LockBit 3.0 Advisory

🔹 Case Study 2: Espionage via Stolen Credentials (APT29)

Attacker: APT29 (Cozy Bear, Russian GRU) Target: UK Defence Contractor (2025) Total Cost: £50M+ (intellectual property theft, incident response) Timeline: 6 months of undetected access

Lessons Learned:

✅ Enforce MFA for all accounts (especially email and privileged access).

✅ Monitor for unusual data access (e.g., large downloads, off-hours activity).

✅ Restrict service account permissions (this account had unnecessary admin rights).

✅ Use DLP (Data Loss Prevention) to block exfiltration of sensitive files.

✅ Conduct regular red team exercises to test detection of APT tactics.

Source: NCSC APT29 Advisory

🔒 What is the most effective way to prevent credential theft?

The most effective way to prevent credential theft is to combine multiple layers of security controls, focusing on prevention, detection, and response. Below is a prioritised, actionable framework based on NIST, NCSC, and CISA guidelines.

• Enforce phishing-resistant multi-factor authentication: Require MFA for all accounts, prioritising phishing-resistant methods (e.g., FIDO2 security keys, hardware tokens). Avoid SMS-based MFA (vulnerable to SIM swapping). (NCSC MFA Guidance);
• Eliminate password reuse with password managers: Deploy enterprise password managers to generate, store, and autofill unique, complex passwords for every account (NIST SP 800-63B);
• Implement zero-trust architecture: Never trust, always verify – Continuous authentication (e.g., behavioural biometrics, device posture checks) (NIST SP 800-207 (Zero Trust);
• Deploy Advanced Threat Detection: Use AI-driven tools to detect anomalous login attempts (e.g., impossible travel, unusual access patterns) (Gartner 2026 Threat Detection Report);
• Conduct Regular Security Awareness Training: Train employees on recognising phishing emails (e.g., urgent requests, spoofed domains), avoiding credential reuse, and reporting suspicious activity.

Zero Trust is a critical framework for preventing identity-based attacks by eliminating implicit trust and verifying every access request. Below is a step-by-step guide to implementing Zero Trust, aligned with NIST SP 800-207, CISA’s Zero Trust Maturity Model, and UK NCSC principles. (NIST SP 800-207)

💡 What are the best practices for securing privileged accounts?

Privileged accounts (e.g., admin, root, service accounts) are high-value targets for cybercriminals, as they provide unrestricted access to critical systems. Below are the best practices for securing them, grounded in NIST, CISA, and NCSC guidelines.

🔐 Why Privileged Accounts Are Targeted

Privileged accounts are disproportionately targeted because they:

✅ Grant access to sensitive data (e.g., PII, financial records, intellectual property).

✅ Allow lateral movement across networks.

✅ Enable attackers to deploy malware, ransomware, or backdoors.

✅ Often lack MFA or monitoring (e.g., service accounts, default credentials).

Statistic: 80% of breaches involve privileged credential abuse (source: Forrester Landscape Report on Privileged Identity Management

💡 What are the key trends in identity security for 2026 and beyond?

The identity security landscape is evolving rapidly, driven by emerging technologies, shifting threat actor tactics, and regulatory changes. Below are the key trends shaping identity security in 2026 and beyond, grounded in authoritative sources like NIST, CISA, NCSC, and Gartner.

🔮 AI and Machine Learning in Identity Security

AI-Powered Authentication:

Behavioural biometrics (e.g., typing patterns, mouse movements, gait analysis) are being integrated into MFA to detect anomalies and prevent account takeovers.

Adaptive authentication uses AI to dynamically adjust login requirements based on risk levels (e.g.,blocking high-risk logins, requiring step-up MFA).

Example: Microsoft Entra ID Protection uses AI to detect and block 99.9% of automated attacks.

AI for Threat Detection:

AI-driven SIEM and UBA tools (e.g., Splunk, Darktrace, Exabeam) are enhancing detection of identity-based attacks (e.g., credential stuffing, lateral movement).

AI-powered fraud detection is stopping deepfake phishing and synthetic identity fraud.

Risks of AI in Cybercrime:

Deepfake phishing (e.g., AI-generated voices/videos) is increasing by 500%.

AI-generated malware (e.g., polymorphic ransomware) is evolving to evade detection.

Source: NIST AI Risk Management Framework (AI RMF)

🔮 Passwordless Authentication

Growth of FIDO2 and WebAuthn:

Passwordless authentication (e.g., FIDO2 security keys, biometrics, magic links) is replacing traditional passwords to eliminate credential theft risks.

Adoption rates are doubling annually, with 40% of enterprises expected to eliminate passwords by 2027.

Example: Google, Microsoft, and Apple now support passkeys (FIDO2-based) for passwordless logins.

Biometric Authentication:

Facial recognition, fingerprint scanning, and voice recognition are becoming standard for high-security environments.

Liveness detection (e.g., 3D depth sensing, infrared cameras) is preventing spoofing attacks.

Source: CISA Hybrid Identity Solutions Guidance

🔮 Zero Trust Architecture (ZTA)

Expansion of Zero Trust:

Zero Trust is becoming the default security model for governments and enterprises, with 80% of organisations expected to adopt ZTA by 2027.

Key focus areas:

• Identity-centric security (e.g., continuous authentication, least-privilege access).
• Micro-segmentation to limit lateral movement.
• Device trust verification (e.g., compliance checks, endpoint security).

Government Mandates:

US Executive Order 14028 (2021) and UK NCSC’s Zero Trust Principles require federal agencies and critical infrastructure to adopt Zero Trust by 2026.

EU’s NIS2 Directive (2024) mandates Zero Trust controls for critical sectors (e.g., energy, healthcare, finance).

Source: NIST SP 800-207 (Zero Trust Architecture)

🔮 Rise of Hacktivism and Nation-State Threats

Hacktivism as a Growing Threat:

Hacktivist groups (e.g., Killnet, Anonymous, GhostSec) are increasingly targeting identities to disrupt operations, leak data, and spread disinformation.

Geopolitical tensions (e.g., Russia-Ukraine war, Israel-Hamas conflict) are fuelling hacktivist campaigns.

Nation-State Identity Attacks:

APT groups (e.g., APT29, APT41, Lazarus) are using stolen credentials for espionage, sabotage, and intellectual property theft.

Example: APT29’s 2025 campaign targeted UK government agencies using phishing and credential harvesting

Source: Europol IOCTA 2026

💡 How can individuals protect themselves from identity-based attacks?

Identity-based attacks target individuals as much as organisations, often leading to financial loss, reputational damage, or physical harm. Below are practical steps individuals can take to secure their identities in 2026.

Key Steps to Secure Your Identity:

✅ Use Strong, Unique Passwords – Avoid reusing passwords; use a password manager (e.g., Bitwarden, 1Password).

✅ Enable MFA Everywhere – Prioritise phishing-resistant MFA (e.g., FIDO2 security keys, biometrics).

✅ Monitor for Leaks – Use Have I Been Pwned to check if your data is compromised.

✅ Freeze Your Credit Report – Prevent fraudulent accounts/loans via Experian, Equifax, or TransUnion.

✅ Limit Public PII – Remove personal details (e.g., home address, phone) from social media, public records.

✅ Secure Devices – Use full-disk encryption, VPNs on public Wi-Fi, and EDR tools (e.g., CrowdStrike, SentinelOne).

✅ Beware of Phishing – Verify sender emails/links; never click suspicious attachments.

✅ Use Privacy Tools – Signal/ProtonMail for encrypted comms; Tor Browser for anonymous browsing.

✅ Report Incidents – Use Action Fraud (UK) or IC3 (US).

Source: NCSC Personal Security Guidance

💡 What role does employee training play in preventing identity-based attacks?

Employee training is a critical line of defence in preventing identity-based attacks, which are among the most common and damaging cyber threats today. These attacks—such as phishing, credential stuffing, and social engineering—often exploit human error rather than technical vulnerabilities. By educating employees about identity and access management (IAM) risks and best practices, organizations can significantly reduce the likelihood of successful breaches.

Why Employee Training Matters

Identity-based attacks rely on tricking users into revealing sensitive information, such as passwords, multi-factor authentication (MFA) codes, or access credentials. Employees who are unaware of these tactics can unknowingly grant attackers access to critical systems. Training helps employees:

• Recognize threats: Phishing emails, fake login pages, and social engineering attempts often contain subtle red flags (e.g., misspelled URLs, urgent language, or requests for sensitive data). Training teaches employees to spot these signs.
• Understand policies: Employees must know why IAM policies exist, such as password complexity requirements, MFA usage, and least-privilege access principles. This ensures they comply willingly rather than viewing policies as obstacles.
• Respond appropriately: Employees should know how to report suspicious activity and who to contact in case of a suspected breach. Clear reporting channels reduce response times and limit damage.

The Bottom Line

Employee training is not a one-time event but an ongoing process. As attack methods evolve, so must training programmes. By fostering a culture of security awareness, organizations can turn employees from potential vulnerabilities into a robust defence against identity-based attacks. Ultimately, well-trained employees are the best safeguard for protecting identities and access in any organization.

💡 How can organisations balance security and usability in identity management?

Organisations often struggle to balance security and usability in identity management. Overly strict security measures can frustrate users, leading to workarounds like weak passwords or shared credentials. Conversely, prioritising usability without security increases the risk of breaches. The key is to design identity management systems that are both secure and user-friendly.

Implement Multi-Factor Authentication (MFA) Thoughtfully

MFA significantly improves security but can frustrate users if poorly implemented.

• Use risk-based MFA: Only require additional authentication for high-risk actions (e.g., accessing sensitive data or off-site logins).
• Offer multiple MFA methods: Allow users to choose between authenticator apps, SMS, or hardware tokens to suit their preferences.
• Avoid overloading users: Too many prompts can lead to “MFA fatigue,” where users bypass security for convenience.

Simplify Password Policies

Complex password rules (e.g., frequent changes, strict complexity) often backfire.

• Encourage passphrases: Long, memorable phrases (e.g., PurpleTurtlesJump@7pm!) are more secure than short, complex passwords.
• Use password managers: Integrate enterprise-grade password managers to reduce cognitive load and improve compliance.
• Avoid forced resets: Frequent password resets lead to weaker passwords. Instead, monitor for suspicious activity and prompt resets only when necessary.

Adopt Zero Trust Principles

Zero Trust assumes no user or device is trusted by default.

• Least-privilege access: Grant employees only the permissions they need for their roles.
• Continuous authentication: Use behavioural analytics (e.g., typing speed, location) to detect anomalies without disrupting legitimate users.
• Contextual access: Adjust authentication requirements based on user behaviour, device security, and location.

Streamline Single Sign-On (SSO)

SSO improves usability by reducing the number of logins while maintaining security.

• Centralise authentication: Use SSO for multiple applications to reduce password fatigue.
• Integrate with MFA: Ensure SSO solutions support MFA for sensitive systems.
• Provide clear feedback: Inform users when their session is at risk (e.g., “Your session will expire in 5 minutes”).

Educate and Empower Users

Users are more likely to comply with security policies if they understand the reasoning behind them.

• Training: Teach employees about phishing, social engineering, and secure password practices.
• Transparency: Explain why certain security measures are in place (e.g., “MFA is required for remote access to protect company data”).
• Feedback loops: Encourage users to share their experiences with authentication systems and suggest improvements.

Leverage Automation and AI

Automation can reduce friction while enhancing security.

• Automated provisioning/deprovisioning: Ensure users have the right access when they need it and revoke it when they leave.
• AI-driven anomaly detection: Use AI to flag suspicious login attempts without requiring manual intervention.
• Self-service password resets: Allow users to reset passwords securely without IT support.

The Bottom Line

Balancing security and usability in identity management requires a user-centric approach. By implementing risk-based MFA, simplifying password policies, adopting Zero Trust, and leveraging automation, organisations can create systems that protect data without sacrificing productivity. The goal is to make security seamless so users don’t have to choose between convenience and safety.