The Breach That Changed How I Think About Cybersecurity

In February 2024, Change Healthcare suffered a ransomware attack that disrupted pharmacy operations and medical claims processing across the entire United States. UnitedHealth Group later confirmed that roughly one-third of all Americans may have had their data exposed. The attack vector? Stolen credentials on a remote access system that lacked multi-factor authentication.

That single failure — one login portal without MFA — cascaded into what became one of the most disruptive cybersecurity incidents in healthcare history. I've been in this industry long enough to know that these catastrophic breaches almost never start with some exotic zero-day exploit. They start with the basics done badly.

This post is for anyone responsible for protecting an organization — whether you run a five-person startup or manage security for a Fortune 500. I'm going to walk you through what's actually working in cybersecurity right now, what's changed, and where most organizations are still getting it wrong.

Why Cybersecurity Basics Still Beat Fancy Tools

Every year, the Verizon Data Breach Investigations Report tells us essentially the same story. In their 2024 DBIR, they found that 68% of breaches involved a human element — social engineering, errors, or misuse of credentials. That number has hovered in the same range for years.

Yet I still walk into organizations that have spent six figures on endpoint detection and response platforms but haven't run a single phishing simulation for their employees. They've got the fanciest locks on the door while handing out copies of the key.

Here's what I've seen consistently separate organizations that get breached from those that don't: the ones that survive take the fundamentals seriously. They patch quickly. They enforce MFA everywhere. They train their people. They verify before they trust.

The Three Controls That Stop Most Attacks

  • Multi-factor authentication on every external-facing system. Not just email — VPNs, cloud admin consoles, remote desktop, everything. The Change Healthcare breach proved what happens when you leave even one door unprotected.
  • Continuous security awareness training. Not a once-a-year compliance checkbox. Your employees face new social engineering tactics every week. A solid program like the cybersecurity awareness training at ComputerSecurity.us keeps your team sharp against evolving threats.
  • Rapid patching. CISA's Known Exploited Vulnerabilities catalog exists for a reason. If a vulnerability is being actively exploited in the wild, you need to patch it in days, not months.

The $4.88M Lesson Most Organizations Learn Too Late

IBM's 2024 Cost of a Data Breach Report put the global average cost of a breach at $4.88 million. That's the highest figure they've ever recorded. For small and midsize businesses, a breach of that magnitude is often an extinction event.

What drives those costs up? Dwell time. The longer a threat actor sits in your environment undetected, the more expensive the cleanup. Organizations that contained a breach in under 200 days saved an average of over $1 million compared to those that didn't.

Detection speed comes down to two things: having the right monitoring in place and having people who know what to look for. Technology alone won't save you. Your employees are either your first line of defense or your weakest link, and the difference is training.

What Is Cybersecurity's Biggest Threat in 2026?

If I had to name the single biggest cybersecurity threat right now, it's credential theft combined with AI-enhanced social engineering. Threat actors are using generative AI to craft phishing emails that are nearly indistinguishable from legitimate business communications. The days of spotting a phishing attempt by its broken grammar are over.

The FBI's Internet Crime Complaint Center (IC3) reported over $12.5 billion in cybercrime losses in their 2023 annual report, with business email compromise and investment fraud leading the pack. Those numbers have only climbed since then.

What makes this especially dangerous is the combination of credential theft and impersonation. An attacker compromises one employee's email through a phishing attack, then uses that legitimate account to send convincing requests to finance, HR, or executives. No malware involved. No firewall to trigger. Just a human trusting another human's email address.

AI-Powered Phishing Is Here — Train for It

Traditional phishing training focused on obvious red flags: misspellings, suspicious sender addresses, generic greetings. That's necessary but no longer sufficient. Your team needs to train against realistic, context-aware phishing scenarios that mirror what actual threat actors are deploying.

This is exactly why I recommend organizations implement ongoing phishing awareness training with simulated attacks. Running regular phishing simulations conditions your employees to pause and verify before clicking, even when the email looks perfect.

Zero Trust: The Framework That Actually Delivers

I used to be skeptical of zero trust. It sounded like another vendor buzzword designed to sell expensive appliances. But after seeing how breaches consistently exploit implicit trust — lateral movement after initial access, trusted insiders gone rogue, compromised VPN credentials granting full network access — I'm a convert.

Zero trust isn't a product you buy. It's an architecture principle: never trust, always verify. Every user, device, and connection must be authenticated and authorized continuously. NIST Special Publication 800-207 lays out the framework clearly.

In my experience, organizations that adopt even partial zero trust principles — microsegmentation, least-privilege access, continuous verification — dramatically reduce their blast radius when a breach does occur. And breaches will occur. Your goal isn't to build an impenetrable fortress. It's to limit damage and recover fast.

Practical Steps to Start Zero Trust Today

  • Inventory your assets and access. You can't protect what you don't know exists. Map every system, every user, every connection.
  • Implement least-privilege access. No employee should have more access than their role requires. Review permissions quarterly.
  • Segment your network. If a threat actor compromises your marketing team's workstation, they shouldn't be able to reach your financial databases.
  • Require MFA for all administrative access. No exceptions.
  • Log everything and review it. Detection depends on visibility.

Ransomware Isn't Going Away — Your Backup Strategy Matters

Ransomware groups have shifted tactics. They no longer just encrypt your data — they exfiltrate it first and threaten to publish it. This double extortion model means even organizations with solid backups face pressure to pay.

Your backup strategy needs to account for this. Air-gapped or immutable backups remain essential, but you also need to encrypt sensitive data at rest so that stolen files are useless to attackers. And you need an incident response plan that you've actually rehearsed, not one gathering dust in a SharePoint folder.

I've responded to ransomware incidents where the organization had backups but had never tested a restore. When the crisis hit, they discovered their backups were corrupted or incomplete. Test your restores quarterly. Make it a calendar event.

Building a Cybersecurity Culture That Sticks

Tools and frameworks matter. But every major breach I've investigated comes back to people. Someone clicked a link. Someone reused a password. Someone ignored a security alert because they were busy.

Building a security-first culture means making cybersecurity part of how your organization operates, not something bolted on afterward. It starts with leadership. When executives take security awareness training alongside everyone else, it sends a message that this matters.

Regular training through a structured program like ComputerSecurity.us's cybersecurity awareness courses keeps security top of mind. Pair that with ongoing phishing simulations and you create muscle memory — the kind that makes your team pause before clicking, even under pressure.

Make Reporting Easy, Not Punitive

One of the most effective changes I've seen organizations make is removing the stigma from reporting security incidents. If an employee clicks a phishing link and is afraid to report it, you lose critical response time. Create a simple reporting mechanism — a button in the email client, a Slack channel, a phone number — and celebrate people who report, even when it's a false alarm.

Your Cybersecurity Checklist for Right Now

  • Enforce MFA on every external-facing system and all admin accounts.
  • Run phishing simulations monthly and track improvement.
  • Patch critical vulnerabilities within 72 hours of disclosure.
  • Implement network segmentation and least-privilege access.
  • Test backup restores quarterly.
  • Train all employees — including executives — at least quarterly.
  • Review and rehearse your incident response plan twice a year.
  • Encrypt sensitive data at rest and in transit.

Cybersecurity isn't a problem you solve once. It's a discipline you practice constantly. The organizations that thrive aren't the ones with the biggest budgets — they're the ones that take the basics seriously, train their people relentlessly, and assume breach is inevitable. Start there, and you're already ahead of most.