CriticalIdentity & AccessA07:2021 – Identification and Authentication Failures
Attackers gain unauthorized access to user accounts through credential stuffing, password reset abuse, session hijacking, or social engineering, enabling data theft, financial fraud, and further compromise.
Immediate Response
1Lock the compromised account and invalidate all active sessions immediately.
2Revert any unauthorized changes made by the attacker (email, password, settings).
3Review account activity logs to determine what data or actions were accessed.
4Notify the account owner through a trusted out-of-band communication channel.
