We had a customer reach out to us saying they could have prevented the Disney attack with Perimeters, so we figured we would write an article to explain exactly how.

Some Context

In early 2024, Disney was hit by a massive internal breach. Not through a supply chain attack, ransomware, or phishing.

It happened through something more subtle, but just as dangerous: an unmanaged SaaS tool installed by an employee.

What Happened Exactly?

According to public reports, an employee at Disney downloaded a third-party AI art generation tool from GitHub.

It wasn’t sanctioned by IT. It didn’t go through security review.

It wasn’t even visible in the company’s SaaS stack.

That tool contained malware, which gave attackers access to the employee’s personal computer.

From there, the attacker gained credentials to internal systems and Slack channels, ultimately exfiltrating over 1 terabyte of internal data, including private communications and sensitive business details.

It was a classic example of Shadow SaaS.

How Perimeters Could Have Prevented It

Perimeters is built to prevent exactly this kind of scenario by making invisible SaaS apps visible and manageable.

Here’s how:

1. Deep Shadow Discovery

Perimeters detects SaaS apps that don’t go through SSO including tools signed up with corporate emails or downloaded directly.
That AI art tool? It would have been flagged immediately as an unapproved, unsanctioned app tied to a work email.

2. Scope & Access Analysis

Perimeters evaluates what each app can do what scopes it’s granted, who uses it, and what kind of access it requests.

If the app had access to sensitive data or permissions beyond basic use, it would’ve been prioritized as a risk.

3. Automated App Justification

When a new app is discovered, Perimeters can automatically ask the user to justify why it’s being used.

In this case, it could have triggered a review or policy block before the app posed a threat.

4. Identity Governance

Even if the app had gone unnoticed, Perimeters’ identity governance would have flagged anomalous logins or data sharing behavior such as excessive file access or access from an unmanaged device.

The Bigger Picture

The Disney breach wasn’t an edge case, it was a mainstream example of how real companies get breached today.

Every org is dealing with:

• Employees signing up for tools on their own
• AI services that bypass SSO
• Permissions granted outside governance
• Lack of visibility into the SaaS estate

Shadow SaaS isn’t a niche problem anymore, it’s an active attack vector.

Want to prevent attacks like this on your org?

With Perimeters, you can:

• Discover every SaaS app in your environment even the ones outside SSO
• Get alerts on unapproved or risky apps as soon as they’re accessed
• Map usage to risk and stop silent exposure before it becomes a breach

Book a demo to see how we could have prevented the Disney attack it in real-time.