Identity Is the Target: Why Credential-Free Authentication Matters

Week of 19 October 2026 | Compiled by Team Paringa

This week's evidence points one way: attackers go after identity because credentials are issued, reused and shared. Supplier accounts and legacy authentication are where the gaps keep showing up.

What Happened This Week

🔴 Semperis: 87% of ransomware victims saw identity systems attacked

Semperis's 2026 Ransomware Risk Report surveyed 1,200 IT and security professionals across nine countries and eight sectors. CBS News reported on 14 October that 87% of respondents were hit by attacks targeting identity systems. The same survey found 84% of victims said attackers used AI, and 44% said attackers exploited their own AI systems. The headline figures describe surveyed victims, not all attacks.

Semperis's Courtney Guss warned that as companies adopt AI agents, "those agents will try to compromise your identity systems", and the report notes agents with broad permissions become a risk if compromised. The Register's coverage adds the human side: 37% of attacks involved psychological or physical threats against staff, 69% of victims were hit more than once in 12 months, and 31% paid more than once. Repeat targeting suggests attackers keep, resell or reuse the access they gain.

Sources: CBS News, The Register

If nearly nine in ten victims saw identity attacked, identity is the main path, not a side door. Many teams rely on MFA from providers such as Microsoft Entra or Okta, but a session that has been stolen after a successful login can still be replayed, which is why even phishing-resistant methods such as FIDO2 do not end the risk. Review how long sessions last, how quickly you can revoke them, and which service accounts and agents hold standing access. Then look at credential-free authentication, where nothing is issued that can be phished or reused.

🔴 "123456" opens Denmark's population register to 8.8 million records

Denmark's government says data on 8.8 million people was accessed in the Central Register of Persons (CPR), which holds about 11 million records. The Register reports that a person claiming responsibility said they got in through an IT company account protected by the password "123456". Politiken reported at least three accounts at the company, including an administrator account, used it. The company, Funen-based Pays ApS, was authorised to access CPR to validate business customers' records.

The attacker accessed CPR on 10 September and ran about 14 million automated searches between 10 and 20 September, according to documents obtained by TV 2. The intrusion was detected on 2 October, after a ministry staffer noticed an invoice showing unusually high activity from Pays. TechRadar reported on 14 October that the login reportedly belonged to a former employee, and that CPR said access came through "abusing a Danish company's legal access". Neither article mentions multi-factor authentication.

Sources: The Register, TechRadar

The lesson is third-party access. A supplier, a shared account and a former employee's login together gave millions of records to an automated script for three weeks. Audit which suppliers hold standing access to your systems, whether accounts are shared, and whether leavers are removed promptly. Passwords are the easy part of the fix, but the stronger answer is authentication where there is no password or code to share in the first place. That is a powerful conversation with any customer that relies on contractors.

🟡 Legacy NTLM enforcement breaks Wi-Fi and VPN sign-ins

Microsoft's October update, released 13 October (KB5127648 for Windows 11, KB5126646 for Windows Server 2025), now enforces NTLMv1 restrictions by default where Credential Guard is disabled, instead of audit mode. Windows Report says this can cause authentication failures on some Wi-Fi, Ethernet and VPN connections using MS-CHAPv2. The Register notes NTLM dates to 1993, and that Microsoft's stated long-term goal is a platform that does not need it.

Microsoft documents a temporary registry workaround that restores audit mode, but warns this weakens security and should be a scoped, temporary exception.

Sources: The Register, Windows Report

Expect help desk tickets, and expect pressure to switch the workaround on and leave it there. Resist that, and use the disruption to inventory what still depends on legacy password-based protocols. A modernisation plan that moves users off shared secrets entirely is easier to justify when the old one is visibly failing.

What Identity Teams Are Dealing With

Identity teams are inheriting risk from three directions: suppliers with standing access, legacy protocols that cannot be switched off without breaking things, and a growing number of non-human identities. The Danish case shows how little it takes when one account is shared and unmonitored.

Boards are also hearing that AI agents will target identity systems. The practical questions are how many accounts and agents hold standing access, how quickly a session can be revoked, and which factors can still be phished or relayed. "We have MFA" is a less convincing answer than it was a year ago.

Three Things Worth Watching Next Week

1. Denmark's CPR investigation — Expect detail on how Pays ApS accounts were managed and what supplier-access rules follow.

2. NTLM fallout — Watch Microsoft guidance as organisations hit the October update issues and decide whether to use the workaround.

3. AI agent identity — Following the Semperis warning, watch for vendor and regulator guidance on governing agent credentials and permissions.

Could not verify: whether MFA was enabled on the Pays ApS accounts; independent confirmation of the Windows registry value name (sources differ).

Questions? hello@paringa.ai

Paringa helps channel partners and their customers move from phishable factors toward credential-free authentication. We focus on what attackers can steal today, and what can be removed from the equation. | 19 October 2026 | © Paringa Ltd