IoT Data Breach – Risks, Best Practices, and Solutions

A recent headline on the Cyber Security News website caught our attention – “Massive IoT Data Breach Exposes 2.7 Billion Records, Including Wi-Fi Passwords.” When we say, “caught our attention,” we mean for a fleeting few seconds. It’s amazing how accustomed our industry has become to headlines that may have been attention grabbing 10-15 years ago.

Cyberattacks are sadly now the norm, and they’re not going away anytime soon. They’re getting more sophisticated, more frequent, and even democratized via “as a service” malware. And this is before we throw in the threats from AI or quantum-equipped adversaries into the mix. The breach above follows the usual script: an unprotected database of 1.17 terabytes – containing 2.7 billion records including passwords, device IDs, API tokens, IP addresses, etc. – exposes a critical vulnerability in IoT device security and cloud storage practices. Aside from the reputational damage to the operators of this database, what might this lead to? The likely result is identity theft or card fraud. For example, smart home device IP addresses at a particular street address can be used to facilitate financial card fraud using stolen credit cards registered to the same street.

In the breach analysis, some common IoT security flaws were identified that apply to any IoT manufacturer:

• Weak Encryption: Many devices rely on outdated protocols like WPA2, vulnerable to brute-force attacks.
• Default Passwords: Users often fail to change factory settings, leaving devices exposed.
• Centralized Cloud Risks: Storing vast data in unsecured servers creates single points of failure.

How Leaders Are Responding

The Cyber Security News article made us recall a recent LinkedIn post from Sameh Younis, Security Priority Lead Architect at Microsoft. Sameh shared his personal insight, detailing 16 emerging cybersecurity trends in 2025. One trend, titled “Edge and IoT broadens attack surfaces,” may seem like a no-brainer, but Sameh identifies what to expect, look for, and – most importantly – change in an organization in order to stay secure. We can summarize his thoughts with:

Companies should embrace the full lifecycle of the IoT device, from cradle to grave.

Best Practices for Securing Machine Identities

IoT devices are a class of machines that often exist in physically unprotected public environments, giving the adversary unrestricted access. Equally, and in this case especially, they are under-protected by the general population. Most consumers are not cybersecurity experts, so the expectation to secure the device falls on the vendor or manufacturer. Due to these factors, the device identity and management system’s database should follow best practices, namely implementing public key infrastructure (PKI) for machine identity and good identity and access management (IAM) plus encryption for sensitive records.

PKI is the go-to technology for machine identity, ensuring the birth and operational digital certificates are robustly enrolled and their lifecycle managed. Databases represent a critical security risk for many organizations and often leverage the native encryption capability known as TDE (transparent data encryption), which enables encryption for entire databases and associated log files. However, managing the keys for encrypted databases is not an easy task. To ensure strong data security, keys must be rotated frequently and carefully protected. Key management solutions (KMSs) and a hardware security module (HSM) root of trust are recognized industry best practices.

Best Practices by Role – Where Should You Start?

• C-Level Executives: Ensure that resources are assigned for IoT/edge-of-the-network risk management. There are a number of policy levers in the arsenal of the risk practitioner when it comes to cryptographic keys, secrets, and certificates. These include the chosen algorithm, the key length, the key rollover frequency, key usage limits, preventing key reuse, clear ownership, restricting permissions, using HSMs for key storage, adding secondary approval for issuance/revocation, trusted roles for operators, audit cadence, etc. But to manage risk, you must have visibility or a continuous cryptographic inventory, as we call it. This part is much easier to say than it is to implement.
• Security Operations (SecOps): Automate endpoint discovery, apply micro-segmentation, and enforce the least privilege.
• Security Professionals: Develop skills for non-traditional endpoints (OT/IoT) and implement best practices early.

The Entrust Difference

Database Security

One simple approach to mitigate the IoT breach would be the encryption of the organization’s database. Database encryption is a standard feature on many enterprise database products like Microsoft SQL Server and Oracle. As organizations store growing volumes of sensitive data in databases, protecting and managing the encryption keys that secure the data becomes increasingly challenging. Encryption keys underpin the security of databases, and if stored alongside the database tables, it puts them at increased risk of compromise.

To mitigate risks and eliminate insider threats, master TDE keys should be carefully managed with role-based access controls and stored separately, when possible, in dedicated hardware. Entrust offers a comprehensive and unified database security platform that ensures critical data is always secured from external and internal threats and available for uninterrupted business.

The Entrust Cryptographic Security Platform's key management solution protects underpinning TDE master keys and provides the flexibility you need to speed up processes – all while helping you mitigate risks and facilitate compliance. The Vault for Databases supports Microsoft SQL Server and Oracle databases.

Least Privilege

Many organizations often overlook establishing proper access controls when deploying their applications and infrastructure. System admins often have unfettered root access, which can leave an organization wide open to this type of attack from external actors and malicious insiders.

As part of a least-privilege model, a strong password (secrets) policy and the use of multi-factor authentication can help thwart attacks. The Entrust Identity and Access Management solution can be implemented to stop attackers in their tracks. Protecting the identities of workers, consumers, and citizens is key to preventing uncontrolled access, data breaches, and fraudulent transactions.

Zero Trust

Zero Trust is one of the frameworks that has gained widespread acceptance. Two of the key pillars of Zero Trust are user and device identity. In the past, we used simple mechanisms to establish user and device serial numbers (or similar) for identity. For users, this typically meant a username and password; for devices, if you were on the network, you were given access.

Today, these are no longer secure; as we know, stolen passwords are commonplace and even many MFA methods are easily breached these days. Passwordless “phishing-resistant” authentication in the form of passkeys, combined with device certificates and sometimes also with facial biometrics for the most sensitive transactions, is now the expected standard.

For machine/device ID, it now needs to be a digital certificate with a chain of trust from manufacturer to end of operational life. With quantum computing on the horizon, a post-quantum cryptographic algorithm should be used. This is especially important if the device's operational lifecycle extends beyond Q-Day, the hypothetical day predicted to be 5-10 years from now when quantum computers will crack current encryption methods.

Whether your organization is actively embracing a Zero Trust philosophy or following your own cybersecurity framework, adversaries will always be creative, and now AI-enabled, to find a weakness and entry point into your critical data. Because no organization is immune, we must all have strategies in place to mitigate cyber threats and continue to raise our security posture. Let’s start with strong machine identities and data-centric security, where encryption provides the last line of defense.

Read the Cyber Security News article we mentioned earlier in this post here.