A nothing event? Having access to our database is a nothing event? For most applications, all they keys a businesses castle are stored in a platform providers parameter store / secret key system. Downtime is bad for customers and slightly bad for a business. Stolen credentials are critical for both.
A stolen key isn't just a key to your customers' private data.
It's a key to your creditcard. Your revenue will be wiped out if you get the AWS bill after hackers booted hundreds of GPU instances under your account, moved terabytes in your data-transfer budgetm, burned tens of thousands of CPU-minutes in github actions under your creditcard, or used thousands of $s worth of tokens with your AI provider.
Obviously. It may even be a key to a no longer active account.
Naturally "a stolen key" here means that the key has access to something worth stealing. And my point was that there's far more worth stealing than your users' private data which many companies don't value that much.
> No, a leaked credential is a nothing event in a mass leak as far as expected loss goes.
Even if that were not absolutely wrong¹ these days², if your risk is mitigated by being one of millions the damage done if you are hit could still be so high that you can't afford to³ knowingly take that risk.
--------
[1] if the credentials can be easily linked to the relevant account, cycling through them to see what useful stuff can be accessed using which is not difficult to quickly automate
Late stage capitalism at its finest; protect the profits at all costs.
Thankfully, they clarified they're in Europe, so GDPR prevents them from ignoring known leaked credentials, lest they have that to deal with, on top of the revenue loss they'll make when all of their customers eventually find out: "they ran leaked credentials knowing our data was at risk, but decided to suck it and see".
You’re better off waiting and monitoring until you’re sure you can get back online if your service supports any kind of revenue.