Each year gets its own review: the incidents that defined it, the themes connecting them, and what they changed about where defenders spend effort. The full step-by-step reconstructions live on the breach kill chains page, and the cross-year synthesis - the patterns that recur regardless of era - is in Lessons From 45 Cloud Breaches.
Reading them in order shows something the individual pages cannot: the attacker's problem changed. In 2021 the hard part was finding a way in. By 2026 the hard part is being noticed.
On this page
The reviews
2026, the first half 9 chains
The year AI stopped being a topic and became a participant. An AI agent conducted a real intrusion against Hugging Face after escaping a capability evaluation. A lone actor took a large AWS estate in 72 hours at a tempo Sygnia inferred was AI-assisted. Meanwhile the AI toolchain itself became the target, and supply-chain attackers found routes around the provenance controls the industry had just finished deploying. Published mid-year and marked as such - this becomes the full 2026 review in January.
2025 11 chains
The year attackers stopped exploiting the cloud and started logging into it. Stolen keys, hijacked OAuth tokens and poisoned dependencies did the work zero-days used to. SaaS-to-SaaS trust chains turned one vendor compromise into hundreds of victims, and extortion crews learned to abuse native cloud features rather than deploying malware.
2024 6 chains
The year the consequences got physical. A missing MFA setting on one remote access portal stopped a third of US healthcare payments for weeks. Meanwhile XZ Utils showed a supply-chain attacker willing to spend two years earning trust, and infostealer logs industrialized into a campaign against 165+ organizations.
2023 8 chains
The year trust infrastructure became the target. Identity providers, file transfer software, CI platforms and support systems - the things every other system depends on - were attacked directly, because compromising one reaches everyone behind it. Cl0p turned mass exploitation into a repeatable business.
2021-2022 7 chains
Where it started. Log4Shell taught the industry it could not answer what was inside its own software. Codecov and Kaseya established the build pipeline and the management plane as targets. And MFA became the battleground - push fatigue at Uber, relayed one-time codes at 130 organizations, and the first demonstration that phishing-resistant factors actually hold.
The arc across five years
Read end to end, the series describes a shift in what is scarce for an attacker.
2021-2022: access was the hard part. The notable incidents turn on getting in - an unauthenticated flaw, a stolen credential, a phished one-time code. Defences were correspondingly perimeter-shaped, and the industry's response to Log4Shell was to start asking what software it was actually running.
2023-2024: access got cheap, so attackers went upstream. Rather than breaching a thousand organizations, compromise the one thing all thousand trust - a file transfer product, an identity provider, a CI platform, a dependency. The victim count per intrusion rose by orders of magnitude while the effort per victim fell to nearly zero.
2025: the trust relationships themselves became the path. Not poisoned artifacts but authorized integrations: OAuth grants, vendor tokens, SaaS-to-SaaS connections that produce no failed login because there is no login. Detection built on authentication events stopped working, because no authentication was happening.
2026 so far: speed and autonomy. Chains that complete in hours rather than months, provenance controls routed around rather than defeated, and operators that are not people. The defensive weight shifts from noticing to constraining - controls that hold without a human in the loop, because the loop is now slower than the attack.
One thing does not move across any of it. In every year, the largest single category is identity: credentials that were valid, tokens that were legitimately issued, and access that had been granted on purpose and never revoked. The tooling changes annually. That does not.
How these are written
Each review draws only on incidents that have a full kill-chain write-up on this site, so every claim traces back to a step-by-step reconstruction with primary sources attached. Where an incident is research rather than a breach - Log4Shell, ChaosDB, the Entra ID Actor token flaw - it is labelled as such rather than counted as a compromise, because the distinction matters for what conclusions you can draw.
Numbers are taken from the primary source that published them, and where reporting disagreed the review says so. Where a widely repeated figure turned out to be wrong - the Polyfill.io "100,000 sites" number was a search tool's result cap, not a measurement - the corrected figure is used and the correction noted.
These pages are opinionated about what mattered and why. They are not comprehensive incident lists; several significant breaches each year are deliberately absent because they repeat a mechanism already covered, and adding them would pad the count without teaching anything new.
Quick answers
Why is there no full 2026 review yet?
Because 2026 is not over. The mid-year page covers January to July and says so plainly; it will be replaced by a complete 2026 review in January 2027. Publishing a "year in review" in July would be a half-year review wearing the wrong title.
Why are 2021 and 2022 combined?
Between them they account for seven kill chains, and they tell one continuous story - the period when the software supply chain and the identity layer both became primary targets for the first time. Split apart, each would be too thin to say anything the other did not.
What is the difference between these and the breach lessons page?
These are chronological: what happened in a given year and what was distinctive about it. Lessons From 45 Cloud Breaches is thematic and timeless - it groups every chain by root-cause pattern regardless of when it happened, and argues that the patterns barely change. Read a year review for the shape of a period; read the lessons page for what to actually do.