Cloud Breaches in 2024 Primarily Caused by Compromised Service Accounts and Forgotten API Keys

In 2024, compromised service accounts and forgotten API keys were responsible for 68% of cloud breaches, surpassing phishing and weak passwords as the primary attack vector. Organizations typically maintain 40 to 50 automated credentials—including service accounts, API tokens, AI agent connections, and OAuth grants—for every employee. These unmanaged non-human identities, often left active after projects conclude or employees depart, create security blind spots. The article highlights the risk posed by orphaned credentials without specifying affected vendors or platforms. No CVE IDs or additional technical details were provided in the excerpt.