Unsecured Credentials
0 confirmed incidents.
VERIS: error:MisconfigurationMITRE ATT&CK: T1552 (Unsecured Credentials)T1526 (Cloud Service Discovery)
MITRE ATT&CK technique names and ids on this page are reproduced and distributed with the permission of The MITRE Corporation. © 2015–2026, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
Unsecured credentials covers an incident where login credentials, API keys or other secrets were exposed because they were stored improperly, in plain text in a file, a script, a public code repository or a misconfigured cloud service, rather than obtained by tricking a user or breaking an authentication system. It maps to two MITRE ATT&CK techniques: T1552 (Unsecured Credentials), locating the exposed secret itself, and T1526 (Cloud Service Discovery), mapping out what a found credential actually grants access to once it is in hand.
No confirmed incidents currently carry this attack-type classification.
Questions and answers
How many confirmed incidents are classified as Unsecured Credentials on Breach Census?
0 confirmed incidents are currently classified as Unsecured Credentials.
Which MITRE ATT&CK techniques does the Unsecured Credentials classification cover?
This classification maps to MITRE ATT&CK techniques T1552 (Unsecured Credentials), T1526 (Cloud Service Discovery).
What counts as a confirmed incident for the Unsecured Credentials classification?
An incident counts here once it carries the Unsecured Credentials attack-type classification and has reached the confirmed status described on the Methodology page; a bare claim or press report is not enough.