SIM-Swap to Data Leak on Dark Web (Incident)

An adversary used a SIM-swap against an employee to access email and SCM accounts, discovered ten cloud access keys (including one with IAMFullAccess) in the source repository, created privileged users to escalate access, performed reconnaissance and lateral movement, and exfiltrated sensitive data that was later posted on the dark web after extortion was refused; primary failures cited are overly permissive identities, credential leaks in code repositories, and insufficient logging.