There's a thread that's been circulating in MSP communities that should make every IT admin's stomach drop. An MSP noticed a cluster of client accounts getting breached — different clients, different industries, different passwords — with no common thread except one: every compromised credential had been stored in IT Glue. No suspicious access events in the logs. No alerts fired. Just a quiet, systematic drain of secrets from a tool that was supposed to be the safest place in the house.
If the vault itself is the attack vector, most teams have no plan. This post gives you one.
Why This Threat Is Real Right Now
This isn't a theoretical scenario. Attackers are actively hunting stored credentials at scale across cloud platforms — and they're getting them.
According to The Hacker News, malicious releases tied to the Trivy hack exposed secrets from over 2,100 organizations — including cloud keys, SSH keys, Kubernetes tokens, and database passwords harvested from 434,000 captured files. That's not a targeted attack on one company. That's a mass-credential-loss event triggered by trusting a compromised tool in a supply chain.
And it's not just package managers. According to a separate report from The Hacker News, a back-end flaw in major AI cloud platforms allowed API keys and passwords to be recovered from session logs — with no visible access events on the customer side. That's the exact fear the IT Glue community raised: a provider-side compromise that leaves your logs clean while your credentials walk out the door.
Schneier on Security reinforces this further, noting that passwords and cryptographic keys stored on cloud platforms are now active targets for automated AI hacking agents — meaning the threat isn't just human attackers manually poking around. It's automated, fast, and designed to harvest at scale before anyone notices.
The lesson: your password manager or documentation tool is a high-value target. If it's cloud-hosted, it's reachable. And if it's breached, you may not know until damage is already done.
Hour 0–2: Assume Breach, Act Immediately
Do not wait for confirmation. If you have credible indicators — unexplained account lockouts, logins from unfamiliar IPs, or a pattern of breaches with no other common factor — treat it as confirmed and move.
-
Isolate the vault. Disable API integrations and third-party connections to your password manager or documentation tool immediately. If IT Glue, Bitwarden, 1Password, or any similar tool has integrations pushing credentials into RMM tools, PSA platforms, or scripts — cut those connections now.
-
Preserve logs before they rotate. Export every available audit log from the platform right now. Log retention windows are short. If there's a back-end compromise, your provider's logs may be the only record of what was accessed.
-
Alert your team and clients. If you're an MSP, your clients need to know. A delayed notification that lets attackers move laterally for 12 more hours is worse than an uncomfortable call at 7 AM.
Hour 2–8: Triage by Risk Tier
You can't rotate every credential simultaneously. Prioritize by blast radius.
Rotate first: - Domain admin and local admin passwords - Firewall and VPN credentials - Microsoft 365 and Azure admin accounts - Any credential tied to billing, payroll, or banking - MFA backup codes and recovery keys
Rotate second: - Line-of-business application accounts - Email service accounts - DNS and registrar credentials - SSL certificate management accounts (see our guide on SSL certificate management and automation for why these matter more than most people think)
Rotate third: - Vendor portal logins - Non-critical SaaS accounts - Internal tooling credentials
As you rotate, do NOT store new credentials back in the compromised platform. Use a temporary offline method — an encrypted local file, a separate emergency vault on a different platform — until you've confirmed the breach vector is closed.
Hour 8–16: Investigate the Vector
While rotation is happening, someone needs to be asking: how did this happen?
- Review provider security advisories. Has your vault vendor acknowledged an incident? Check their status page, their security disclosure page, and breach notification databases.
- Check for unauthorized API tokens. Many credential tools allow API access. Enumerate every active token and revoke anything you don't recognize.
- Look for lateral movement. Compromised credentials don't just sit there — they get used. Pull login logs from Microsoft 365, your firewall, and any remote access tools. According to The Hacker News, an actively exploited Windows privilege-escalation zero-day (CVE-2026-68820) is currently being used in the wild — if credentials were used to gain initial access, attackers may have already escalated.
- Check for new admin accounts, new forwarding rules in email, and new scheduled tasks on endpoints.
If you've dealt with a compromised remote management tool before, the investigation process has significant overlap — our RMM tool breach emergency playbook covers the lateral movement investigation steps in detail.
Hour 16–24: Contain, Document, and Harden
Contain: Any account or system where you can't confirm credential rotation should be treated as compromised. Disable it until rotation is complete.
Document everything. Incident timeline, what was rotated and when, what access logs showed, who was notified. This matters for cyber insurance claims, client communication, and any regulatory reporting obligations.
Harden before you re-open: - Enable MFA on the vault platform itself if it wasn't already enforced (and audit whether MFA was actually required or just optional) - Review which users had access to which credential sets — least privilege applies to your password manager too - Evaluate whether your vault's integrations are actually necessary or just convenient — every integration is an attack surface - Consider whether your current tool's security posture matches the sensitivity of what you're storing in it
For MSPs specifically, this is also the moment to review how credential access is segmented across clients. If one client's vault compromise could expose another client's credentials, that's an architectural problem that needs fixing before the next incident.
As we covered in our post on accidental credential exposure through third-party integrations, the integrations you set up for convenience are often the same ones attackers exploit for access.
The Uncomfortable Truth About Vault Security
No password manager is breach-proof. Cloud-hosted tools trade some security for accessibility, and that trade-off is acceptable — until it isn't. The goal isn't to avoid using these tools. It's to have a plan for when they fail, and to layer defenses so that a vault breach doesn't automatically mean a total business compromise.
That means MFA everywhere. Least privilege on vault access. Monitoring for anomalous credential use. And a written incident response plan that your team has actually read before the crisis hits.
Take Action: Don't Wait for a Breach to Find Your Gaps
A password vault breach is catastrophic precisely because it exposes everything at once. The best time to find your credential exposure risks is before an attacker does.
Oscar Six Security's Radar scans your external attack surface for exposed credentials, misconfigured services, and the vulnerabilities attackers use to pivot after initial access — for $99 per scan. It won't replace an incident response plan, but it will tell you what's visible to attackers right now, before they act on it.
Focus Forward. We've Got Your Six.