In short
In short: when you read that someone got into a system "without a password", that doesn't mean they guessed it. It means they went through an entrance where they were never asked for a password at all. That's why the phrase "unauthenticated access" is the scariest one in a breach report. It doesn't say the lock was broken. It says that door never had a lock to begin with.
Every online service you use - your bank, your mail, the shop you buy from - has one main entrance. There they ask who you are: email and password. That's the check. Its purpose is simple: to let exactly you in. Not the first passerby off the street.
The problem is a building rarely has just one door. There's a side one, for deliveries. There's a ground-floor window nobody thought to lock. If the main door has a sturdy lock but the side one has none at all, a thief doesn't bother with the main one. They just push the side door open and walk in.
Imagine logging into your bank account with a password, as always. But that same bank also has a separate page - say, for checking an exchange rate, or a support question - that asks for neither email nor password, because it looks harmless. If that page is connected behind the scenes to the same system, someone can walk straight through it to other people's data. They haven't guessed anyone's password. They've simply picked the door nobody realized was a door at all.
That's exactly why this phrase scares more than any other in a breach report. However complex a password you've come up with, it only guards the door it's put on. It doesn't guard the one next to it.
An example from October 28, 2026: Drupal announced a hole in Commerce Core, the online-shop module (CVE-2026-118539). In Drupal's words the module does not sufficiently protect certain routes and entity fields, and the type of the hole is access bypass. Drupal rates it 'Highly critical' (21 out of 25 on its own scale) and writes that it is already being attacked. The advice to merchants is to audit their orders for inconsistencies, not just update: the fix is in versions 3.3.13 and 8.x-2.41. Here the door without a lock leads to the orders, and the orders are the money.
A strong password guards the door you put a lock on. It doesn't guard the door someone forgot was a door at all.
What sits underneath
As someone who builds such systems myself, this is what bothers me most. You pour weeks into the main entrance - strong password, extra verification, everything by the book. And then you leave some side feature open, because "it's internal, who's going to find it". They find it. Not people sitting around guessing passwords, but automated programs that walk around the building from outside, feeling every door and window.
So when I see the words "unauthenticated access" in a report like that, I don't look at how complex the company's password is. I look at whether anyone walked around the whole building at all, not just the front entrance.
The visual is generated code-art, no third-party images.