Stolen logins trigger three supply‑chain breaches in early 2026

Stolen logins triggered three separate supply‑chain breaches in the early months of 2026. One incident exposed 4 TB of internal data at Mercor, including contractor records.

Axios was hijacked for a few hours and used to deliver malware to anyone who installed it during that window. The same Trivy breach also gave attackers access to hundreds of private code repositories inside Cisco's development environment. A compromised credential behaves like a stolen keycard, letting the wrong person use a valid key to enter a secured system. Teams often share a single login or store passwords in plain text in deployment scripts, optimizing for speed rather than security. Most development teams never skip a code review, treating it as a core step that catches flawed changes before they ship. Credentials rarely receive the same scrutiny, with teams often sharing a single login to avoid the overhead of individual accounts. Deployment scripts frequently contain plain‑text passwords because they were the quickest way to meet a deadline, not because of carelessness. Teams prioritize shipping speed, leaving credential management to be addressed later, which attackers can exploit. Because the incidents followed a similar pattern against well‑resourced teams, the risk has become predictable and can be planned for. Locking dependencies to tested versions and maintaining a full software bill of materials help teams know what is running, but do not stop unauthorized changes.

What we know

• Three separate supply‑chain breaches occurred in the early months of 2026.

• Axios is included in more than 100 million software installations each week.

• The Trivy breach exposed 4 TB of internal data at Mercor, including contractor records.

• The Trivy breach gave attackers access to hundreds of private code repositories inside Cisco's development environment.