Attackers stole data on 1.2 million individuals after compromising a PennKey SSO account in the 2025 University of Pennsylvania breach, a case that illustrates how a single set of credentials can expose a broad estate of services.
How the 2025 University of Pennsylvania breach mapped SSO risk to many systems
According to reporting, the intrusion began with a compromised PennKey single sign-on (SSO) account. From that foothold the attackers reached internal systems including VPN, Salesforce, Qlik, SAP, and SharePoint, and used that access to exfiltrate data on 1.2 million people. That sequence underscores a core truth in the source material: convenience concentrates risk when one credential unlocks many resources.
NIST guidance on passwords and the hard numbers on credential theft
The source cites current NIST recommendations for password policies and couples those with industry breach statistics. For single-factor password scenarios, NIST recommends a minimum length of 15 characters. Where passwords are used alongside multi-factor authentication (MFA), NIST recommends at least eight characters and that systems allow up to 64-character passwords. NIST also advises checking new passwords against blocklists of commonly used, expected, or previously compromised passwords, and warns against mandatory complexity rules and routine resets that push predictable user behavior.
The scale of credential exposure shows why those controls matter: Verizon’s Data Breach Investigation Report found stolen credentials are involved in 44.7% of breaches. The guidance in this reporting couples length, usability, and blocklisting as the practical countermeasures to that common attack vector.
MFA must be enforced widely — and be phishing-resistant where it counts
The material stresses that MFA is essential for SSO but warns against a checkbox approach. MFA should be enforced consistently across users, applications, and access scenarios rather than only for a handful of “high-risk” accounts. The source draws a distinction between legacy second factors and stronger, phishing-resistant solutions: SMS codes and basic one-time passwords are characterized as “better than passwords alone” but not the strongest options.
For privileged users and access to sensitive systems, the reporting recommends moving toward phishing-resistant methods such as FIDO2 security keys, WebAuthn, or passkeys. The vendor cited in the story — Specops Secure Access — is described as a solution that applies MFA to SAML and OIDC-based applications and extends MFA to Windows Logon, RDP, and VPN authentications.
Lock down the identity plumbing: IdP admins, certificates, OAuth, and consent
Securing the SSO login is necessary but not sufficient; the source emphasizes hardening the assets and authorities that sit behind SSO. Identity provider (IdP) administrator accounts deserve special protection because they can change authentication policies, add applications, reset users, and approve integrations. Recommended controls include phishing-resistant MFA, separate admin accounts, just-in-time access, and close monitoring of administrator activity.
SAML signing certificates and token-signing keys are singled out as high-value targets: they allow applications to trust the IdP, and if exposed attackers may be able to impersonate users or abuse trusted sessions. The guidance is to tightly limit access to those keys, trigger alerts on changes, and rotate certificates before they expire. OAuth artifacts—client secrets, app credentials, and refresh tokens—are also risky because they can provide long-lived access without an additional interactive login; the report recommends storing such secrets in a vault, rotating them regularly, and reviewing app registrations for excessive permissions.
Finally, the source highlights consent grants and delegated permissions as avenues attackers use to maintain access. Practical steps called out include restricting user consent, requiring admin approval for sensitive permissions, and removing stale or overprivileged grants.
What this means for security teams, procurement leaders, and end users
- Security teams and technologists: Treat SSO as a critical control — enforce strong password policies per NIST, apply MFA consistently, adopt phishing-resistant factors for privileged access, monitor IdP admin actions, rotate certificates, and vault OAuth secrets.
- Procurement and IT procurement leaders: Evaluate vendors on concrete capabilities noted in the report — support for OIDC and SAML, MFA coverage for RDP/VPN/Windows Logon, and password blocklisting — and require controls that help satisfy audits and cyber insurance conditions.
- End users and the general public: The convenience of SSO remains real, but your single login can be a single point of failure; use the strongest available MFA methods for sensitive accounts and follow organizational guidance on passkeys or security keys where offered.
SSO still offers clear operational and compliance benefits — reduced password sprawl, centralized policy enforcement, fewer help-desk tickets, and a single place to revoke access — but it is not secure by default. The reporting’s prescription is practical and specific: enforce NIST-aligned password measures and blocklists, expand and harden MFA toward phishing-resistant methods, and lock down identity-critical artifacts such as IdP admin credentials, signing keys, and OAuth secrets. Those steps close the pathways attackers used in the PennKey incident and reduce the chance that one compromised login becomes a breach affecting millions.
Original story: https://www.bleepingcomputer.com/news/security/is-your-sso-protected-against-modern-credential-attacks/
