Computer Security News and Insights
In early 2024, Ivanti disclosed critical vulnerabilities in its Connect Secure VPN that were already being actively exploited by threat actors — including nation-state groups. CISA issued an emergency directive ordering federal agencies to disconnect affected devices within 48 hours. It was a brutal reminder: a VPN isn't a
A Single Exposed RDP Port Cost One Hospital Everything In 2023, a regional hospital in Illinois discovered that attackers had been inside their network for over three weeks. The entry point? A single Remote Desktop Protocol (RDP) port left open to the internet. The threat actors used brute-forced credentials to
In 2023, MGM Resorts lost an estimated $100 million after a threat actor social-engineered a help desk employee using information scraped from LinkedIn. One phone call. One employee without clear verification protocols. That's all it took to shut down slot machines, hotel key cards, and reservation systems across
The Policy Nobody Reads Until It's Too Late In 2023, a single employee at MGM Resorts called the help desk, and a threat actor used social engineering to gain access that led to a $100 million hit on operations. One phone call. No malware exploit. No zero-day vulnerability.
The Audit Finding That Costs More Than the Breach In 2023, a regional healthcare provider in Oklahoma paid a $1.3 million HIPAA settlement to the Office for Civil Rights. The root cause wasn't a sophisticated nation-state attack. It was a phishing email that an untrained employee clicked
The Framework 87% of Organizations Claim to Follow — But Most Get Wrong When the Change Healthcare breach exposed the records of over 100 million people in 2024, investigators found something familiar: the organization had a cybersecurity program on paper. What it lacked was disciplined execution against a proven structure. That
In January 2024, CISA issued Emergency Directive 24-01 after a nation-state threat actor compromised Microsoft's corporate email environment. Federal agencies scrambled to audit their own Microsoft tenants. The directive wasn't theoretical — it was an emergency response to a real breach affecting the backbone of government communications.
The $5.8 Billion Wake-Up Call You Can't Afford to Ignore In 2023, the FTC finalized sweeping updates to the Safeguards Rule. By 2024, enforcement actions were landing on companies most people had never heard of — small mortgage brokers, auto dealers, online retailers. The message was clear: the
A Single Ransomware Attack Shut Down Patient Care for 28 Days In early 2024, Change Healthcare — one of the largest health payment processors in the United States — was hit by the ALPHV/BlackCat ransomware group. The breach disrupted claims processing for thousands of providers nationwide. UnitedHealth Group later confirmed approximately
The Breach That Cost a Children's Charity Everything In 2023, Save the Children Federation confirmed it was hit by the BianLian ransomware group, which claimed to have stolen nearly 7 GB of data including financial records, personal information, and medical data. A global nonprofit with significant resources still
