The Attack Path Your Last Cross-Cloud Transfer Left Behind

Every cross-cloud data transfer is also an IAM event — on both sides. When the transfer completes, the data is in the right place. The credentials are often not revoked.

What actually happens.

A service account gets created on the source side. Another on the destination. Both get more privileges than necessary — because debugging cross-cloud IAM failures at 2 AM is painful. Both persist after the job completes. Nobody owns the cleanup.

What the Okta breach tells us.

In October 2023, Okta was breached via a service account with permissions to view all customer support cases. Credentials persisted in an unmonitored location. 134 customers were affected. One over-permissioned account. One unmonitored location. That was enough.

The cross-cloud transfer risk.

Every ad-hoc cross-cloud transfer creates the same pattern at scale. Service accounts on both sides, over-provisioned, never revoked. Each one is a bridge between two environments that an attacker did not have to build — your team already built it.