The question
The vendor in question is a large telecom carrier — the kind of company with a dedicated security operations budget, not a two-person IT shop. Reporting says the accounts stayed accessible to attackers for more than a year using credentials nobody had flagged as compromised.
What we told them
Most small businesses don't have a real answer to "would we notice," and it's not because their IT is bad — it's because a stolen login doesn't look like an attack. There's no malware to catch, no exploit to patch, no alarm that fires. It's just someone with a password that still works, logging in from somewhere unusual, doing things that look ordinary if nobody's watching for the pattern.
The mechanism that catches this isn't antivirus and it isn't a firewall — it's login monitoring. Impossible-travel alerts (a sign-in from Ohio ten minutes after one from overseas), new-device alerts, off-hours access, and — critically — someone or something actually reviewing those signals instead of letting them sit in a log nobody opens.
Here's the gap we see most often: a client has MFA turned on, feels covered, and stops there. MFA is genuinely good — it blocks a huge share of casual credential-stuffing attempts. But it doesn't help once a session token or a working password is already in an attacker's hands and being reused the normal way. At that point MFA narrowed the front door; it didn't do anything about how long someone can stay once they're in, and dwell time is exactly what the telecom story is about.
Three things worth checking this week: whether your Microsoft 365 or Google Workspace tenant actually alerts on impossible-travel and new-device sign-ins — not just failed logins; how far back your sign-in logs go, since a lot of default retention windows are 30–90 days and a year-long compromise would simply outlive your own evidence; and who, specifically, looks at those alerts, and how often. "We have logging" and "someone reviews the logging" are two very different sentences.
Catching a stolen login isn't about stopping the break-in — it's about noticing someone's still walking around inside afterward. If nobody's watching sign-in activity, an attacker doesn't need to be clever. They just need to be patient.