BePrime Breach: Lack of MFA Causes Data Leak

Key Takeaways

• No MFA, one password, full access. A stolen administrative login without a second factor was enough to gain complete system access.
• 12.6 GB of public data. Plaintext passwords, PostgreSQL superuser IDs, MinIO S3 data, and Meraki API keys were stolen and published.
• 1,858 network devices compromised. Client devices were breached via stolen Cisco Meraki API keys; surveillance cameras were accessible via live feed.
• Exposed clients. Iberdrola, Whirlpool, Alsea, and ArcelorMittal, including confidential security audit reports with documented vulnerabilities.
• 
  

  What the attacker found: an open system

  The exploit was straightforward. The attacker, alias “dylanmarly,” gained access to an admin account lacking multi-factor authentication. A single stolen password sufficed for full system access. What followed was not a sophisticated intrusion, but a simple retrieval of everything that was accessible.

  What the 12.6 GB of stolen data contained:

  1. Plaintext passwords – Credentials were neither hashed nor encrypted. A fundamental error considered unacceptable for decades.
  2. PostgreSQL superuser IDs – Full access to databases containing customer data. A unique identifier, with no concept of rotation.
  3. MinIO S3 bucket data – Object storage containing internal documents; MinIO is generally used for sensitive operational data.
  4. Cisco Meraki API keys – Here lies the true escalation: Meraki API keys allow total control of connected network equipment. 1,858 devices were compromised.
  5. Internal client security audit reports – This is the most problematic part for those affected. These documents describe vulnerabilities in client infrastructures. They are now accessible to the public.
  6. Live surveillance feeds – Through the compromised Meraki consoles, feeds from active surveillance systems were accessible.

  Clients appearing in the stolen data: Iberdrola (energy provider), Whirlpool, ArcelorMittal, and Alsea (operator of Starbucks and Domino’s in Latin America).

  Compliance theater versus real security operations

  What BePrime had	What was missing
  Security service offerings for clients	MFA on their own admin accounts
  Audit reports on client security	Credential encryption in the database
  Trust relationship with sensitive clients	Least privilege for API keys and service accounts
  Public communication regarding t What DACH security teams can do in concrete terms Three directly applicable consequences of this incident: First: Security assessments of vendors must be technical, rather than based solely on documentation. A questionnaire asking whether multi-factor authentication (MFA) is active does not prove that it actually is. Access to a technical test – or at least a screenshot of the Entra/Okta report – should become the standard. Second: Third-party API keys require scoping and rotation. Meraki API keys with full access to 1,858 devices in a service provider system represent a risk, regardless of the quality of protection. Editor’s Picks Editor’s PickTop-Tier Phishing: How CISOs Protect Their ChannelsEditor’s PickBitwarden CLI Hit by GitHub Actions Supply ChainEditor’s PickEU AI Act launches Aug 2, yet high‑risk oversight gap persists More from the MBF Media Network cloudmagazinQuantum Computing: IonQ Forte Traps DACH IT in a Cost PitDigital Chiefs5G Campus Networks: Regulator Awards 465 FrequenciesMyBusinessFutureGenerative AI in Mid-Market Companies: Why the 78-Percent Figure Is Misleading Further reading Case Studies · July 15, 2026 Nihon Kotsu: Dispatch Disrupted After Malware Attack Nihon Kotsu reports malware on July 11, 2026. Dispatch systems offline, AiLock ransom claim filed July 15. Case study with key lessons for control … Case Studies · July 14, 2026 Northern German Workshop Adopts DataManagement as a Service for M365 Backup from Pink Elephant M365 Backup via DataManagement as a Service: A social institution uses Pink Elephant for data backup, recovery and German hosting. Case Studies · July 7, 2026 When a Phone Call Halted Car Production On 31 August 2025, systems at Jaguar Land Rover began behaving strangely. A few days later, production came to a standstill. For five weeks, … Multilingual WordPress with WPML A magazine by Evernine Media GmbH