{"id":14240,"date":"2026-04-29T19:53:18","date_gmt":"2026-04-29T19:53:18","guid":{"rendered":"https:\/\/www.securitytoday.de\/2026\/05\/08\/beprime-breach-april-2026-case-study-wie-fehlende-mfa-in\/"},"modified":"2026-09-26T14:37:13","modified_gmt":"2026-09-26T14:37:13","slug":"beprime-breach-lack-of-mfa-causes-data-leak","status":"publish","type":"post","link":"https:\/\/www.securitytoday.de\/en\/2026\/04\/29\/beprime-breach-lack-of-mfa-causes-data-leak\/","title":{"rendered":"BePrime Breach: Lack of MFA Causes Data Leak"},"content":{"rendered":"<p><strong>A security firm fails to set up MFA on its own admin accounts. One stolen password later: 12.6 GB of customer data made public, 1,858 network devices under outside control &#8211; plus plaintext passwords in the stolen files.<\/strong><\/p>\n<p style=\"color:#69d8ed;font-size:0.9em;margin:0 0 16px;padding:0;\">6 min read<\/p>\n<div style=\"background:#003340;color:#fff;padding:32px 36px;margin:32px 0;border-radius:8px;\">\n<p style=\"margin:0 0 18px 0;font-size:0.95em;font-weight:800;text-transform:uppercase;letter-spacing:0.2em;color:#69d8ed;border-bottom:2px solid rgba(105,216,237,0.25);padding-bottom:12px;\">Key Takeaways<\/p>\n<ul style=\"margin:0;padding-left:22px;color:rgba(255,255,255,0.92);line-height:1.6;\">\n<li style=\"margin-bottom:12px;\"><strong style=\"color:#69d8ed;\">No MFA, one password, full access.<\/strong> A stolen admin login without a second factor was enough for complete system access.<\/li>\n<li style=\"margin-bottom:12px;\"><strong style=\"color:#69d8ed;\">12.6 GB of data made public.<\/strong> Plaintext passwords, PostgreSQL superuser credentials, MinIO S3 data and Meraki API keys were stolen and published.<\/li>\n<li style=\"margin-bottom:12px;\"><strong style=\"color:#69d8ed;\">1,858 network devices taken over.<\/strong> Attackers used stolen Cisco Meraki API keys to take over customer devices &#8211; surveillance cameras were accessible live.<\/li>\n<li style=\"margin-bottom:12px;\"><strong style=\"color:#69d8ed;\">Customers exposed.<\/strong> Iberdrola, Whirlpool, Alsea and ArcelorMittal &#8211; including confidential security audit reports with documented vulnerabilities.<\/li>\n<li><strong style=\"color:#69d8ed;\">Response: lawyers&#8217; letters.<\/strong> BePrime&#8217;s incident response consisted mainly of legal threats against journalists covering the story.<\/li>\n<\/ul>\n<\/div>\n<p><strong>What is BePrime?<\/strong> BePrime is a Mexican cybersecurity provider that offers managed security services to mid-sized and large companies. Its customers include companies from the energy, steel, consumer goods and food service sectors &#8211; all industries with a high need to protect operational technology and network infrastructure.<\/p>\n<p>The BePrime incident is instructive because it shows what happens when compliance and security operations drift apart. BePrime is no small startup without a security budget. The company is a cybersecurity provider &#8211; it professionally protects other firms against exactly these attacks. Yet it failed to implement the simplest available control in-house.<\/p>\n<p>That is the core of this case study: the missing MFA matters less than the gap between compliance rhetoric and operational security reality. That gap is so wide that it exists even inside security firms.<\/p>\n<div style=\"display:flex;gap:16px;flex-wrap:wrap;margin:32px 0;\">\n<div style=\"flex:1;min-width:140px;text-align:center;background:#f0f9fa;border-radius:12px;padding:24px 16px;\">\n<div style=\"font-size:42px;font-weight:700;color:#69d8ed;letter-spacing:-0.02em;\">12.6 GB<\/div>\n<div style=\"font-size:14px;color:#444;margin-top:8px;\">of stolen data made public<\/div>\n<div style=\"font-size:11px;color:#888;margin-top:6px;\">Source: databreaches.net, April 2026<\/div>\n<\/p><\/div>\n<div style=\"flex:1;min-width:140px;text-align:center;background:#f0f9fa;border-radius:12px;padding:24px 16px;\">\n<div style=\"font-size:42px;font-weight:700;color:#69d8ed;letter-spacing:-0.02em;\">1,858<\/div>\n<div style=\"font-size:14px;color:#444;margin-top:8px;\">Meraki devices taken over<\/div>\n<div style=\"font-size:11px;color:#888;margin-top:6px;\">Cisco Meraki network devices<\/div>\n<\/p><\/div>\n<div style=\"flex:1;min-width:140px;text-align:center;background:#f0f9fa;border-radius:12px;padding:24px 16px;\">\n<div style=\"font-size:42px;font-weight:700;color:#69d8ed;letter-spacing:-0.02em;\">2,600<\/div>\n<div style=\"font-size:14px;color:#444;margin-top:8px;\">connected devices exposed<\/div>\n<div style=\"font-size:11px;color:#888;margin-top:6px;\">total affected across the network<\/div>\n<\/p><\/div>\n<\/div>\n<h2>What the attacker found: an open system<\/h2>\n<p>The sequence of events was unspectacular. An attacker using the alias &#8220;dylanmarly&#8221; gained access to an admin account without multi-factor authentication. One stolen password was enough for full system access. What followed required no advanced intrusion technique: the attacker simply grabbed everything within reach.<\/p>\n<p>What the 12.6 GB of stolen data contained:<\/p>\n<ol>\n<li><strong>Plaintext passwords<\/strong> &#8211; Credentials were stored without hashing or encryption. A basic mistake that has been considered unacceptable for decades.<\/li>\n<li><strong>PostgreSQL superuser credentials<\/strong> &#8211; Full access to databases holding customer data. A single credential with no rotation concept.<\/li>\n<li><strong>MinIO S3 bucket data<\/strong> &#8211; Object storage with internal documents; MinIO is typically used for sensitive operational data.<\/li>\n<li><strong>Cisco Meraki API keys<\/strong> &#8211; This is where the real escalation lies: Meraki API keys grant full control over connected network devices. 1,858 devices were taken over.<\/li>\n<li><strong>Internal customer security audit reports<\/strong> &#8211; This is the most problematic part for those affected. These documents describe vulnerabilities in customer infrastructures. They are now publicly accessible.<\/li>\n<li><strong>Live surveillance feeds<\/strong> &#8211; Through the hijacked Meraki consoles, camera feeds from active surveillance systems were accessible.<\/li>\n<\/ol>\n<p>The customers that appear in the stolen data: Iberdrola (energy utility), Whirlpool, ArcelorMittal and Alsea (operator of Starbucks and Domino&#8217;s in Latin America).<\/p>\n<h2>Compliance theater versus real security ops<\/h2>\n<table style=\"width:100%;border-collapse:collapse;margin:24px 0;\">\n<thead>\n<tr style=\"background:#f0f9fa;\">\n<th style=\"padding:12px 16px;text-align:left;border-bottom:2px solid #69d8ed;font-size:0.95em;color:#69d8ed;\">What BePrime had<\/th>\n<th style=\"padding:12px 16px;text-align:left;border-bottom:2px solid #004a59;font-size:0.95em;color:#69d8ed;\">What was missing<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr style=\"border-bottom:1px solid #e8e8e8;\">\n<td style=\"padding:12px 16px;color:#444;\">Security services portfolio for customers<\/td>\n<td style=\"padding:12px 16px;color:#444;\">MFA on its own admin accounts<\/td>\n<\/tr>\n<tr style=\"background:#fafafa;border-bottom:1px solid #e8e8e8;\">\n<td style=\"padding:12px 16px;color:#444;\">Audit reports on customer security<\/td>\n<td style=\"padding:12px 16px;color:#444;\">Encryption of credentials in the database<\/td>\n<\/tr>\n<tr style=\"border-bottom:1px solid #e8e8e8;\">\n<td style=\"padding:12px 16px;color:#444;\">Position of trust with sensitive customers<\/td>\n<td style=\"padding:12px 16px;color:#444;\">Least privilege for API keys and service accounts<\/td>\n<\/tr>\n<tr style=\"background:#fafafa;border-bottom:1px solid #e8e8e8;\">\n<td style=\"padding:12px 16px;color:#444;\">Public communication about its expertise<\/td>\n<td style=\"padding:12px 16px;color:#444;\">Credential rotation and monitoring of API key usage<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:12px 16px;color:#444;\">Customer data stored and managed<\/td>\n<td style=\"padding:12px 16px;color:#444;\">Incident response that goes beyond lawyers&#8217; letters<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>The response: a lesson in misplaced priorities<\/h2>\n<p>After the breach became public, BePrime released no technical analysis. No public communication to customers. Instead: legal threats against journalists who reported on the incident.<\/p>\n<p>Security teams should know this pattern well. The reason has little to do with rarity: it is a reliable signal of how mature a company is. Anyone whose first thought under incident pressure goes to the legal department instead of forensic investigation and customer communication has failed to internalize security as an operational discipline.<\/p>\n<p>The irony is hard to miss: BePrime writes security audit reports for customers &#8211; and exactly these reports sat unencrypted in the system and are now public. Including the customer vulnerabilities documented in them. Beyond the reputational damage for BePrime, this creates a direct risk for Iberdrola, ArcelorMittal, Whirlpool and Alsea.<\/p>\n<h2>What DACH security teams can concretely do<\/h2>\n<p>Three directly actionable consequences of this incident:<\/p>\n<p>First: vendor security assessments must include technical verification, since documents alone prove little. A questionnaire that asks about MFA is no proof that MFA is active. Access to technical evidence &#8211; or at least an Entra\/Okta reporting screenshot &#8211; should become standard.<\/p>\n<p>Second: third-party API keys need scoping and rotation. Meraki API keys with full access to 1,858 devices in a service provider&#8217;s system are a risk regardless of how well the provider is secured. Least-privilege API keys that are read-only and rotate automatically beat permanent full-access credentials.<\/p>\n<p>Third: security audit reports are highly sensitive documents. They describe vulnerabilities. Wherever the service provider stores them, they must meet the same protection requirements as the systems they describe.<\/p>\n<h2 style=\"padding-top:64px;margin-bottom:20px;\">Frequently Asked Questions<\/h2>\n<p class=\"st-faq-hint\">Each question is locked. One tap unlocks the answer.<\/p>\n<details>\n<summary><strong>What is multi-factor authentication and why is a password alone insufficient?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">MFA requires a second proof in addition to the password &#8211; typically a TOTP code or a push notification. A stolen password alone therefore grants no access. In the BePrime case, MFA would very likely have stopped the attack, since the attacker had no access to the second-factor device.<\/p>\n<\/details>\n<details>\n<summary><strong>Why are plaintext passwords in databases a risk in their own right?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">Stolen hashed passwords can often be cracked with modern GPUs, yet that costs time and resources. Plaintext passwords are usable immediately &#8211; for credential stuffing against other services, lateral movement and account takeover. Storing passwords in plaintext goes beyond a configuration error: it is a fundamental flaw that has no place in any system holding production data.<\/p>\n<\/details>\n<details>\n<summary><strong>What should affected companies (BePrime customers) do now?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">Priority one: rotate all credentials BePrime ever had access to &#8211; API keys, service account passwords and shared logins. Priority two: check whether the publicly available stolen data contains details about their own network. Priority three: review the Meraki configurations and audit logs of their own devices for unauthorized access.<\/p>\n<\/details>\n<details>\n<summary><strong>How exactly would MFA have stopped this attack?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">MFA works at the authentication layer. If the attacker &#8220;dylanmarly&#8221; had an admin password but no access to the second-factor device, the login would have failed. There are scenarios in which MFA can be bypassed (SIM swapping, authenticator phishing), yet these require considerably more effort than simple credential theft. The BePrime breach did not look like a targeted, sophisticated attack.<\/p>\n<\/details>\n<details>\n<summary><strong>Which compliance standards make MFA mandatory for privileged accounts?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">Article 21 of NIS2 requires technical and organizational measures to secure privileged access &#8211; MFA is implicit there and often explicit in national implementations. DORA requires financial service providers to have IAM controls that include MFA. ISO 27001:2022 explicitly names MFA in Annex A as a control for privileged access. For a security provider operating in NIS2-relevant sectors, MFA was never an optional nice-to-have.<\/p>\n<\/details>\n<div class=\"evm-styled-box\" style=\"background:#f0f9fa;border-radius:8px;padding:20px 24px;margin:24px 0;border-top:3px solid #69d8ed;\">\n<!--ST-LOWER-CARDS lang=en--><\/p>\n<h3 style=\"margin:48px 0 18px;padding-left:12px;font-size:1.05em;font-weight:800;color:#e6e3da;border-left:3px solid #69d8ed;line-height:1.2;\">Editor&#8217;s Picks<\/h3>\n<p><a href=\"https:\/\/www.securitytoday.de\/en\/2026\/04\/28\/klockner-prien-graichen-when-the-top-brass-clicks-a-phishing-link\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:inset 0 1px 0 rgba(230,227,218,0.06),0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/04\/kloeckner-prien-graichen-top-level-phishing-april-2026-cover-hero-250x141.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#69d8ed;margin-bottom:5px;\">Editor&#8217;s Pick<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">Top-Tier Phishing: How CISOs Protect Their Channels<\/span><\/span><\/a><a href=\"https:\/\/www.securitytoday.de\/en\/2026\/04\/28\/bitwarden-cli-checkmarx-github-action-supply-chain-devsecops\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:inset 0 1px 0 rgba(230,227,218,0.06),0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/04\/st-hero-17489157-250x167.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#69d8ed;margin-bottom:5px;\">Editor&#8217;s Pick<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">Bitwarden CLI Hit by GitHub Actions Supply Chain<\/span><\/span><\/a><a href=\"https:\/\/www.securitytoday.de\/en\/2026\/04\/28\/eu-ai-act-high-risk-deadline-august-2026-supervisory-gap\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:inset 0 1px 0 rgba(230,227,218,0.06),0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/04\/eu-ai-act-hochrisiko-stichtag-august-2026-aufsichts-vakuum-hero-250x167.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#69d8ed;margin-bottom:5px;\">Editor&#8217;s Pick<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">EU AI Act launches Aug\u202f2, yet high\u2011risk oversight gap persists<\/span><\/span><\/a><\/p>\n<h3 style=\"margin:48px 0 18px;padding-left:12px;font-size:1.05em;font-weight:800;color:#e6e3da;border-left:3px solid #69d8ed;line-height:1.2;\">More from the MBF Media Network<\/h3>\n<p><a href=\"https:\/\/www.cloudmagazin.com\/en\/2026\/04\/29\/ibm-quantum-heron-ionq-forte-quas-vergleich-dach-enterprise\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:inset 0 1px 0 rgba(230,227,218,0.06),0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-ibm-quantum-heron-ionq-forte-quas-vergle-70086591.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#0bb7fd;margin-bottom:5px;\">cloudmagazin<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">Quantum Computing: IonQ Forte Traps DACH IT in a Cost Pit<\/span><\/span><\/a><a href=\"https:\/\/www.digital-chiefs.de\/en\/5g-campus-networks-regulator-awards-465-frequencies\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:inset 0 1px 0 rgba(230,227,218,0.06),0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-5g-campus-netze-mittelstand-2026-cio-bil-27415920-250x166.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#e8828d;margin-bottom:5px;\">Digital Chiefs<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">5G Campus Networks: Regulator Awards 465 Frequencies<\/span><\/span><\/a><a href=\"https:\/\/mybusinessfuture.com\/en\/generative-ai-in-mid-market-companies-why-the-78-percent-figure-is-misleading\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:inset 0 1px 0 rgba(230,227,218,0.06),0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-generative-ki-mittelstand-78-prozent-nut-84172784-250x137.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#aa8ac2;margin-bottom:5px;\">MyBusinessFuture<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">Generative AI in the Mittelstand: Why the 78-Percent Figure Is Misleading<\/span><\/span><\/a><!--\/ST-LOWER-CARDS--><\/p>\n","protected":false},"excerpt":{"rendered":"**Missing MFA at a cybersecurity firm: 12.6 GB of data stolen, 1,858 Meraki devices compromised\u2014what DACH teams can learn from the BePrime breach.**","protected":false},"author":10,"featured_media":13645,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"Study of","_yoast_wpseo_title":"BePrime Breach: Lack of MFA Causes Data Leak","_yoast_wpseo_metadesc":"No MFA on admin accounts cost BePrime 12.6 GB of customer data and control of 1,858 network devices. What security teams should learn from the breach.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"evm_kih_original":false,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_pin_until":0,"evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":["beprime-breach-april-2026-case-study-wie-fehlende-mfa-in"],"footnotes":""},"categories":[255],"tags":[],"class_list":["post-14240","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-praxis-umsetzung-en"],"evm_reading_time_minutes":7,"wpml_language":"en","wpml_translation_of":13646,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/14240","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=14240"}],"version-history":[{"count":10,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/14240\/revisions"}],"predecessor-version":[{"id":24091,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/14240\/revisions\/24091"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/13645"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=14240"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=14240"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=14240"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}