Why Cloud Security Failures Continue to Expose Data and People to Unnecessary Cyber Risks

Why It Matters

These failures undermine citizen privacy, disrupt essential government services, and impose massive financial and reputational penalties on both public and private sectors.

Key Takeaways

• Conduent breach exposed 25 million records and exfiltrated 8 TB of data
• IBM 2025 study finds 99% of cloud failures stem from customer misconfigurations
• Multi‑cloud deployments multiply attack surface without unified CSPM controls
• Zero‑trust and MFA adoption remains below 40% across federal agencies

Pulse Analysis

The past year has underscored how fragile cloud environments remain for both private firms and government contractors. High‑profile incidents such as the Conduent ransomware attack, which leaked personal data of roughly 25 million individuals and siphoned 8 TB of information, Snowflake’s credential‑theft breach affecting over 165 customers, Change Healthcare’s mis‑configured Citrix portal that released 192.7 million health records, and Ingram Micro’s API compromise illustrate a pattern of low‑hanging exploits. Despite the hype around multi‑cloud agility, the underlying security hygiene has not kept pace, leaving sensitive PII, health data, and investigative files exposed to ransomware and credential‑stuffing attacks.

The root causes are largely operational rather than technological. IBM’s 2025 cloud‑security report attributes 99% of failures to customer‑side misconfigurations—over‑permissive IAM policies, unpatched APIs, and the omission of multi‑factor authentication. Multi‑cloud architectures that span Azure, OCI, and Google Cloud further fragment visibility, making unified Cloud Security Posture Management (CSPM) difficult. Shared‑responsibility models are routinely ignored, with vendors pointing fingers while agencies rely on checklist‑driven compliance such as FedRAMP, which often lacks real‑time enforcement. CISA’s zero‑trust mandate has reached only about 40% of federal agencies, leaving a large attack surface unchecked.

Addressing the crisis requires moving beyond compliance boxes to enforceable security contracts. Governments should embed zero‑trust proofs, continuous telemetry sharing, and mandatory MFA into every vendor agreement, while demanding automated configuration audits and regular penetration testing before workloads go live. For private firms, consolidating CSPM tools across cloud providers and adopting a “security‑by‑design” mindset can shrink the breach window dramatically. The stakes are high: each breach not only incurs remediation costs—often hundreds of millions—but also erodes public trust and jeopardizes critical services that millions of citizens depend on.