Security Overview

Identity exposure

• ARAlex RuizImmediate reviewCreated 148 service accounts, minted ci-nightly key; Exploit.in credential leak3 open findingsdevops@platform45.com
• DTDavid ThorneImmediate reviewSuper Admin & GCP Owner roles held; LinkedIn 2012 breach; Exploit.in alert0 open findingsdavid.thorne@platform45.com
• APArthur PendeltonImmediate reviewTargeted wire fraud lure recipient in inbox; Adobe 2013 breach on file1 open findingarthur.pendelton@platform45.com
• MBMarcus BrodyImmediate reviewSetIamPolicy owner escalation author; MySpace legacy breach2 open findingsmarcus.brody@platform45.com
• NPNoah PatelImmediate reviewCollection #1 exposure; payroll credential phishing lure recipient0 open findingsfinance@platform45.com
• BSBrandon ScottImmediate reviewBambooHR tax document drill: clicked lure & submitted 12 characters; coaching active1 open findingbrandon.scott@platform45.com
• MCMaya ChenExposedLinkedIn 2012 breach; recipient of fake Google Workspace password expiry lure1 open findingmaya@platform45.com
• CMChloe MartinExposedNorthwind vendor overdue invoice lure in inbox; Houzz 2019 breach0 open findingschloe.martin@platform45.com
• EWEmma WatsonExposedCompleted Google Workspace security training; BambooHR portal administrator0 open findingsemma.watson@platform45.com
• SJSarah JenkinsExposedCollection #1 credential breach exposure; frequent executive spear-phish target0 open findingssarah.jenkins@platform45.com
• DRDevina RaoExposedVertex AI spike batch author; OpenAI sk-proj key detected in Notion runbook0 open findingsdevina.rao@platform45.com
• OVOlivia VanceExposedZoomInfo scrape; SuperCalendar risky OAuth app grant author; fake DocuSign lure target2 open findingsolivia.vance@platform45.com
• SOSam OkonkwoExposedLive Stripe key pasted into Jira PAY-1842; vendor invoice lure recipient0 open findingssam@platform45.com
• MVMarcus VanceExposedExposed GitHub token in Jira ticket DEV-1402; LastPass 2022 security advisory1 open findingmarcus.vance@platform45.com
• JKJordan KrossExposedLeaked database credentials in Jira ticket OPS-771; Cloud SQL 0.0.0.0/0 author1 open findingjordan.kross@platform45.com
• GMGabriel MercerExposedAuthor of Customer Portal legacy login; AllUsers read ACL configured on bucket0 open findingsgabriel.mercer@platform45.com
• SLSophia LinExposedChegg 2018 breach; recipient of urgent invoice wire request0 open findingssophia.lin@platform45.com
• FZFatima ZahraExposedAlert Center: Suspicious login from unusual geographical IP (Novosibirsk, Russia)1 open findingfatima.zahra@platform45.com
• LVLiam VanceExposedCanva 2019 breach; GCP monitoring alert subscriber0 open findingsliam.vance@platform45.com
• KCKenneth ClarkeExposedKaggle credential dump 2021 exposure; BigQuery public endpoint configured0 open findingskenneth.clarke@platform45.com
• TSTravis Scott-MillerExposedEvite 2019 breach; GitHub Actions runner maintenance operator0 open findingstravis.miller@platform45.com
• MWMegan WalshExposedParkMobile 2021 breach; Stripe billing dashboard admin0 open findingsmegan.walsh@platform45.com
• LGLucas GrayExposedApollo.io 2018 breach; high external inbound email volume0 open findingslucas.gray@platform45.com
• TRTyler RossExposedDubsmash 2018 breach; frequent target of cold outreach spoofing0 open findingstyler.ross@platform45.com
• JBJustin BellExposedLinkedIn breach exposure; Ironclad contract lifecycle manager0 open findingsjustin.bell@platform45.com
• RSRachel SterlingWatchDropbox 2016 breach exposure; password rotated in 20240 open findingsrachel.sterling@platform45.com
• ZTZachary TaylorWatchZynga 2019 breach exposure; Terraform pipeline operator0 open findingszachary.taylor@platform45.com
• OWOwen WrightWatchVerifications.io 2019 breach; GCP monitoring alert oncall0 open findingsowen.wright@platform45.com
• KDKevin DuarteWatchLinkedIn 2021 scraping exposure; Salesforce CRM owner0 open findingskevin.duarte@platform45.com
• NCNatalie ChenWatchCanva 2019 breach; Figma and Notion marketing workspace admin0 open findingsnatalie.chen@platform45.com
• ERElena RostovaWatchClear; active hardware security key enforcement; zero unrotated credentials0 open findingselena.rostova@platform45.com
• AMAisha MoralesWatchApollo.io 2018 corporate contact scrape; no password exposure0 open findingsaisha.morales@platform45.com
• DBDylan BrooksWatchWattpad 2020 credential exposure; enrolled in Google Security Keys0 open findingsdylan.brooks@platform45.com
• AHAlicia HuangWatchMyFitnessPal 2018 breach; dual approval authorized for wire transactions0 open findingsalicia.huang@platform45.com
• JRJessica ReedWatchGravatar 2020 scrape; Google Ads & Hubspot OAuth manager0 open findingsjessica.reed@platform45.com
• CSCarlos SantanaWatchAdobe 2013 breach; Zendesk & customer feedback portal manager0 open findingscarlos.santana@platform45.com
• RORyan OberholzerWatchProject Lead for Client: Howler through Platform45; isolated project scope0 open findingsryan@platform45.com
• BOBenjamin OrtizWatchArmor Games breach; Lever ATS administrator0 open findingsbenjamin.ortiz@platform45.com
• PNPriya NairWatchSlack webhook shared in incident notes; no public breaches on file1 open findingpriya@platform45.com
• TBTimothy BradleyWatchClear; internal audit evidence reviewer0 open findingstimothy.bradley@platform45.com
• ECEthan ColeClearNo breaches on file; MFA hardware key verified0 open findingsethan.cole@platform45.com
• NANadia Al-MansoorClearNo breaches on file; zero external credentials detected0 open findingsnadia.almansoor@platform45.com
• JZJulian ZhaoClearClear; internal container cluster maintainer0 open findingsjulian.zhao@platform45.com
• LBLeo BergClearNo breach on file; clean mailbox triage records0 open findingsleo@platform45.com
• DMDerek MeyerClearClear; NetSuite & billing API administrator with hardware MFA0 open findingsderek.meyer@platform45.com
• HAHannah AbbottClearClear; Google Workspace 2-Step Verification enforced0 open findingshannah.abbott@platform45.com
• DKDaniel KimClearClear; Google Analytics & Tag Manager administrator0 open findingsdaniel.kim@platform45.com
• MFMorgan FoxClearClear; external partner collaboration channels verified0 open findingsmorgan.fox@platform45.com
• CHClara HigginsClearClear; SOC 2 and GDPR compliance audit coordinator0 open findingsclara.higgins@platform45.com
• SLStephanie LiuClearClear; employee onboarding checklist owner0 open findingsstephanie.liu@platform45.com

Reaction queue

What to do next

• 148 service accounts created in 20 minutes

  devops@platform45.com

  critical

• IAM policy escalation: SetIamPolicy granting roles/owner to external identity

  marcus.brody@platform45.com

  critical

• Exposed GitHub personal access token in Jira ticket DEV-1402

  marcus.vance@platform45.com

  critical

• Google SCC threat: Cryptomining container detected on GKE cluster

  k8s-pod:prod-core-gke/worker-79cb

  critical

• User-managed service account key minted on ci-nightly

  devops@platform45.com

  high

• Phishing email lure: fake IT Okta / Google Workspace session expiry

  maya@platform45.com

  high

• Security awareness drill in progress: BambooHR tax document simulation (Compromised)

  brandon.scott@platform45.com

  high

• Database password in deployment ticket OPS-771

  jordan.kross@platform45.com

  high

• Google SCC threat: Persistence: IAM Service Account Actor Added

  marcus.brody@platform45.com

  high

• Google Workspace Alert: Mass Google Drive document export by privileged user

  arthur.pendelton@platform45.com

  high

• Risky OAuth App Grant: 'SuperCalendar Sync' authorized with full mail & drive scopes

  olivia.vance@platform45.com

  high

• Phishing email lure: fake DocuSign agreement sent to Olivia Vance

  olivia.vance@platform45.com

  high

• Google Workspace Alert: Suspicious login from unusual geographical IP

  fatima.zahra@platform45.com

  medium

• Slack webhook shared in public incident notes

  priya@platform45.com

  medium

• Stale unrotated Admin service account key (384 days active)

  devops@platform45.com

  medium