Technology & SaaS2023 / 2024
Source: Microsoft ·
Microsoft: stolen email became a route to further access
Microsoft reported that attackers used information from stolen corporate email to pursue further access.
Read the briefingFilter briefings
Find a case like yours
Start with your industry, or explore the access decision you face.
Years refer to incidents or evaluations, not later source reports. Cases without a stated incident year are grouped separately. Filters can be combined.
All briefings
Page 4 of 5
Government & public sector2021
Source: Information Commissioner’s Office ·
UK Ministry of Defence: a recipient list became a disclosure
Group emails disclosed addresses in the Afghan relocation programme; this was a separate 2021 incident.
Read the briefingTechnology & SaaS2023
Source: Okta ·
A support file can carry the power to sign in
Session tokens inside troubleshooting files turned a support-system breach into account access.
Read the briefingHealthcare & life sciences2013
Source: HHS Office for Civil Rights ·
Montefiore: a staff login did not justify access to every patient
An HHS settlement records inappropriate access to 12,517 patients’ account information.
Read the briefingHealthcare & life sciences · Consumer servicesYear not specified
Source: Federal Trade Commission ·
BetterHelp: permission to provide care was not permission to advertise
The FTC’s final order addressed health information shared for advertising after privacy promises.
Read the briefingGovernment & public sector · Technology & SaaS2023
Source: Microsoft ·
Storm-0558: forged tokens crossed an email trust boundary
A token-validation issue let attackers use forged authentication tokens to access email.
Read the briefingHealthcare & life sciences · Consumer services2019 / 2020
Source: Federal Trade Commission ·
1Health: deletion promises need an inventory of the data
The FTC alleged public genetic-data storage and deletion promises the company could not reliably honor.
Read the briefingConsumer services · Technology & SaaSYear not specified
Source: Federal Trade Commission ·
Ring: private footage needs a reason for every viewer
The FTC challenged broad internal video access, unconsented training uses, and account-security failures.
Read the briefingNo briefings match these filters
Try a broader search or remove a filter to explore related cases.
Why we’re building Vivendur
These briefings make the need for clearer access boundaries concrete. Vivendur is building private AI memory so organizations can choose what each tool receives for a task. The cases inform that work: limiting unnecessary disclosure, separating permissions between tools, and being clear about what happens after information is shared.
Our approach to reporting
We link to original disclosures, distinguish incident dates from publication dates, and label our interpretation. These cases raise different security questions; they do not establish that Vivendur could have prevented them.
See these access decisions in Vivendur in action