Credential Theft Wasn’t Suspected Until Logins Looked Too Normal
The logins didn’t fail.
They succeeded.
That was the first clue.
A user logged in at 2:03 a.m. Another at 2:17. Same account. Different locations. Both successful.
No alarms triggered. No lockouts.
“Probably VPN glitches,” someone said.
The administrator wasn’t convinced.
Microsoft had been warning customers all year: passwords alone were no longer enough. Credential theft wasn’t loud. It didn’t announce itself. It blended in.
They pulled authentication logs. Compared timestamps. Looked for patterns.
The pattern was subtle.
Access outside normal hours. Short sessions. No file deletions. No obvious damage.
Just presence.
Someone had credentials. Valid ones.
The account belonged to a former contractor. Disabled in theory. Still active in practice.
“How did this happen?” management asked.
“It was never fully removed,” IT said. “We assumed it expired.”
Assumptions again.
The account was locked immediately. Passwords reset. Access reviewed across systems.
No breach was confirmed. No data loss proven.
But no one was reassured.
By the end of February, account reviews became routine. Departures triggered checklists. Access expiration dates were enforced.
Microsoft’s guidance was clear: identity was now the perimeter.
The organization finally treated it that way.
