IT Attacks Increasingly Use Hijacked Identities
Cyberattacks are increasingly occurring through compromised user identities rather than traditional system breaches. Data from Nordlo's security center shows the number of incidents in Sweden has tripled in eight months.
IT service company Nordlo reports a significant shift in cyberattack methods, with compromised user identities becoming a more common entry point than traditional system breaches. This trend poses new challenges for businesses.
Data gathered by Nordlo's Security Operations Center (SOC) reveals a threefold increase in detected and prevented incidents involving malicious activity through stolen credentials in Sweden between October 2025 and May 2026. This development is linked to the growing accessibility of business systems and services online, which diminishes the effectiveness of traditional security measures like firewalls.
"We are observing a completely new pattern that is much harder to defend against, affecting both small and large businesses," stated Magnus Blomberg, CTO at Nordlo. He explained that when attackers use valid login credentials, their actions can appear as normal usage, potentially bypassing conventional security tools.
According to a study commissioned by Nordlo from analysis firm Radar, three out of four Swedish organizations prioritize increasing employee awareness of cybersecurity. Nordlo's SOC service continuously analyzes vast amounts of data to identify anomalous patterns in real-time, enabling the detection and interception of intrusions even when they occur using legitimate user credentials. Blomberg emphasizes that employee awareness must be combined with technology and continuous monitoring for comprehensive protection, especially considering that many attacks occur during off-hours when staff are limited.