By EcoGreen Solutions

Over 225,000 tech workers have been laid off in 2026 so far, across more than 500 separate events — and by most trackers, roughly 4 in 10 of those cuts are tied directly to AI-driven restructuring. Monday.com, Microsoft, Oracle, GitLab, Intuit, Meta, and Cloudflare have all made headlines this year for workforce reductions as they retool around AI. Oracle’s single cut in March alone accounted for 30,000 roles.

Buried underneath every one of those headlines is a much quieter number that almost never makes the news: how many logins, API keys, integration tokens, and devices tied to those roles actually got shut off.

A Four-Year-Old Credential Nobody Remembered

In June 2026, sales intelligence platform Klue confirmed a breach that shows exactly what happens when that quiet number gets ignored. According to Klue’s CEO, attackers gained access using a credential that had been created back in 2022 for a limited pilot project — and simply never decommissioned. Four years later, that forgotten access point was still live, still connected, and still trusted by the system.

Using it, attackers obtained OAuth tokens Klue held for its customers and used those tokens to reach into connected Salesforce environments. The fallout hit some of the biggest names in security: LastPass, Huntress, Recorded Future, Tanium, and Jamf were all affected, with a threat group calling itself “Icarus” claiming responsibility.

Nobody was hacked because of a zero-day. They were hacked because of a credential that outlived the project, the team, and possibly the employees who set it up — a classic offboarding gap, just one that took four years to surface.

Why This Matters More in a Layoff Year

IBM’s 2026 Cost of a Data Breach report puts real numbers behind the stakes:

Roughly 1 in 4 malicious breaches now involves AI on the attacker’s side, and 62% of AI-driven attacks target critical infrastructure. Despite this, only 37% of organizations encrypt their data at rest and in transit.

Every layoff, restructuring, or team dissolution multiplies this exposure. Each departing employee can leave behind laptops, cloud access, shared drives, API keys, VPN credentials, and third-party integrations. When teams move fast to cut costs, IT offboarding is frequently the step that gets rushed — or skipped. Klue’s four-year-old credential is proof that a single overlooked access point doesn’t need to be exploited immediately to become a liability. It just needs to be forgotten.

Where the Real Gap Sits

Most companies have a checklist for the obvious stuff: disable the email account, collect the badge, reclaim the laptop. Far fewer have a real process for closing out the accumulation of integration credentials, pilot-project tokens, and legacy access that built up over years of hiring, restructuring, and vendor onboarding — the exact kind of asset that caused the Klue breach.

That gap is precisely where EcoGreen Solutions works. Our EcoGreen Data Lifecycle Framework — Audit, Classify, Optimize, Retire, Recover — is built around the idea that data and device security doesn’t end when a project or an employee moves on. It’s the point where risk usually begins:

The 2026 layoff wave isn’t slowing down, and neither is the AI-driven pressure behind it. Organizations that treat offboarding as a full lifecycle process — not a one-day checklist — are the ones that won’t end up as the next Klue.