Supply Chain Case Study: Leaked credentials of an HRMS Provider’s Employee Expose Critical Employee Information and PII for a Bank and Multiple Subsidiaries; Allows Account Takeover

**Executive summary:** A support employee at an HRMS vendor downloaded cracked software infected with an information-stealer, which exfiltrated credentials to attackers who then gained admin-level access to the HRMS of a prominent bank and its subsidiaries, exposing employee PII and enabling account takeover, privilege escalation, and potential payroll and identity fraud; the report outlines the attack chain and provides containment and prevention recommendations.