The Forgotten Business Accounts Outside Your SaaS Inventory.

A total of 4 breach events were found and analysed resulting in 480,981 exposed accounts containing a total of 18 different data types of personal datum. The breaches found publicly and freely available included Evermotion, Westrock Coffee Company, IBIS Open Forum and Animal Nexus. Sign in to view the full library of breach events which includes, where available, reference articles relating to each breach.

Specialist services are part of the real technology estate

Evermotion creates 3D models, scenes and environments for architecture, gaming and film. The IBIS Open Forum manages technical standards used for electronic and interconnect modelling. Animal Nexus describes a digital platform connecting participants across the livestock sector. Westrock Coffee Company provides coffee, tea, extracts and beverage solutions through a global sourcing and manufacturing network.

[Evermotion describes its creative services](https://evermotion.org/projects/about-us), the [IBIS Open Forum explains its standards work](https://www.ibis.org/), and [Westrock Coffee outlines its business platform](https://westrockcoffee.gcs-web.com/).

These descriptions provide industry context. They do not establish which systems or data types were involved in each event. They do demonstrate how varied professional account use can be. Designers may need digital assets, engineers may participate in standards communities, agricultural businesses may use sector platforms, and procurement or product teams may interact with specialist suppliers.

None of those activities is inherently unusual or inappropriate. The challenge is that the resulting accounts may be invisible to the people responsible for identity security.

The BreachAware team has recorded and reviewed the provenance of this material. The descriptions shared here are intentionally limited, providing defenders with useful context without publishing source locations, detailed contents or information that could encourage misuse.

Not every unmanaged account is unauthorised

It is tempting to describe every service outside the central application register as shadow IT. The reality is more nuanced.

An employee may have been asked to join an industry forum, download an approved asset or communicate with a supplier. The activity may be entirely legitimate while the account itself remains individually managed. This creates a gap between business approval and identity management. The organisation may not know:
- Which employee owns the account
- Whether a corporate or personal address was used
- Whether the password is unique
- Whether multi-factor authentication is available
- What information has been uploaded
- Whether colleagues share the account
- Whether it remains needed after a role change
- How it will be recovered if the original owner leaves

A service does not need to be business-critical to create risk. It only needs to hold useful information, reuse a credential or retain a relationship that nobody remembers to remove.

Professional context can make a small dataset relevant

The 480,981 exposed accounts found this week represent a lower volume than many previous summaries. That does not automatically make every event low priority.

A niche professional account can reveal an employee’s function, interests or connection to a particular industry. An account associated with 3D assets may point towards a designer or architect. Participation in an electronics standards forum may indicate engineering expertise. A livestock platform or beverage supplier relationship can provide commercial context.

These examples are based on the public functions of the named services, not claims about the specific contents of the exposed records.

The defensive relevance depends on which verified fields were present and whether the information remains current. A corporate email address linked to a specialist service may help an organisation discover an account that was otherwise absent from its records.

That makes exposure monitoring useful for more than incident response. It can also reveal parts of the organisation’s real application footprint.

Forgotten accounts create a lifecycle problem

Centrally managed applications normally have an owner, an approved configuration and a process for removing access. Individually created accounts may have none of those controls.

When an employee moves role or leaves, the account can remain active. A former employee may continue receiving notifications, accessing purchased material or representing the organisation within a professional community.

Shared accounts create an additional problem. When several people use one login, the organisation may be unable to determine who performed an action or safely remove one individual’s access.

Dormant accounts can also retain:
- Contact and profile information
- Purchase or subscription history
- Downloadable resources
- Saved projects or preferences
- Messages with suppliers and community members
- Organisational names and relationships

The presence of these fields should not be assumed in this week’s events. They illustrate why an account’s end-of-life arrangements matter even when the service is relatively specialised.

Shadow IT is usually a signal, not misconduct

Employees generally adopt external tools because they are trying to complete a legitimate task. A designer needs an asset, an engineer needs technical documentation or a commercial team needs to work with a sector-specific provider.

The UK National Cyber Security Centre defines shadow IT as unknown assets used for business purposes outside normal asset-management and risk processes. Its guidance stresses that this is rarely caused by malicious intent; employees often turn to unofficial services because approved tools or request processes do not meet their needs. [Read the NCSC guidance on shadow IT](https://www.ncsc.gov.uk/guidance/shadow-it).

A punitive response can reduce visibility by teaching employees not to disclose the services they use.

A more productive approach is to make specialist tools easy to declare, assess them proportionately and bring important accounts under appropriate control.

What the weekly totals do and do not show

The 480,981 exposed accounts should not be interpreted as the same number of unique or newly affected people. The total may include:
- Historical or inactive accounts
- More than one account belonging to the same person
- Duplicate records
- Information already circulated elsewhere
- Accounts no longer connected to the original employer

The 18 data types were identified across all four events. This does not mean that every record contained all 18, or that each event involved the same information.

The sample also does not show that creative, electronics, beverage or livestock organisations were disproportionately affected. The names provide context from this week’s findings rather than evidence of a broader sector trend.

Three defensive checks for B2B organisations

1. Make specialist services easy to declare
Provide a simple, proportionate process through which employees can register an external platform or request access to a new tool.

The process should distinguish between a low-risk professional forum and a service that will store sensitive data, connect to corporate systems or process payments. Requiring the same lengthy review for every account encourages workarounds. Use discovery as an opportunity to understand what employees need, rather than beginning with blame.

2. Set minimum controls for work-related accounts
Employees should use unique passwords and a managed password manager for services that cannot use corporate single sign-on. Multi-factor authentication should be enabled where it is available.

Avoid shared credentials. Where a service supports team membership, create individually attributable accounts and assign an organisational owner.

Corporate email addresses should not automatically be prohibited, as they can make ownership and discovery easier. Their use should be accompanied by a process that ensures the account can be transferred or closed.

3. Extend offboarding beyond the main application list
Ask departing employees and their managers about specialist platforms, communities, supplier portals and paid resources used in the role.

Review password-manager records, procurement information and declared services to identify accounts requiring closure or transfer. Remove stored organisational information where it is no longer needed and update external contacts when ownership changes.

The objective is not to reconstruct every website an employee has visited. It is to retain control of professional relationships and information that should remain with the business.

The wider lesson

This week’s findings demonstrate that an organisation’s true account estate is usually larger than its formal SaaS inventory.

Specialist tools and communities help people perform valuable work. The risk emerges when legitimate accounts become invisible, individually owned and disconnected from normal security processes.

Businesses do not need to centrally administer every professional website. They do need enough visibility to understand which accounts contain organisational information, depend on corporate identities or should be transferred when somebody leaves.

The most useful question is not simply, “Did we approve this application?” It is, “Does this account support our work, and do we still control its lifecycle?”