Computer Security News and Insights
In 2023, a single compromised file transfer tool — MOVEit — cascaded into breaches affecting over 2,600 organizations and roughly 90 million individuals. The threat actor, the Cl0p ransomware group, didn't need to hack each victim directly. They exploited one vendor, and the dominoes fell. That's third
The Breach That Didn't Start With You In 2023, the MOVEit Transfer vulnerability didn't just hit Progress Software. It cascaded through thousands of organizations — government agencies, banks, healthcare systems — because those organizations trusted a single vendor's file transfer tool. Over 2,600 organizations and
The $350 Million Wake-Up Call Nobody Expected When Verizon acquired Yahoo in 2017, a previously undisclosed breach affecting 3 billion accounts forced the deal price down by $350 million. That single failure of cybersecurity due diligence became the most expensive cautionary tale in M&A history — and it permanently
Your Employees' Passwords Are Already for Sale In March 2024, a single dark web marketplace listed over 10 billion stolen credentials. That's not a typo. The Verizon 2024 Data Breach Investigations Report found that stolen credentials were involved in roughly 31% of all breaches over the past
Your Stolen Password Is Probably Already There In 2024, a single dark web marketplace called BreachForums was seized by the FBI — and then resurrected by its users within two weeks. That tells you everything about the persistence of the underground economy. If you've ever wondered what is the
In May 2024, the FBI and international partners seized BreachForums — one of the largest marketplaces where stolen credentials on the dark web were bought and sold in bulk. The forum had facilitated the sale of billions of compromised records, including credentials tied to U.S. government agencies, healthcare organizations, and
In January 2024, Roku disclosed that a credential stuffing attack compromised roughly 591,000 user accounts across two separate incidents. Attackers didn't hack Roku's servers. They simply took username-and-password pairs leaked from other breaches and tried them at scale. It worked because hundreds of thousands of
A 22-Character Password Cracked in Under 4 Hours In 2023, a security researcher demonstrated that a 22-character password using only lowercase letters could be brute-forced in under four hours on consumer-grade GPU hardware. That wasn't a theoretical exercise — it was a wake-up call. Brute force attack prevention isn&
In January 2024, a threat actor used credential stuffing to compromise a test environment at Microsoft — and then pivoted to access senior leadership email accounts for weeks before detection. Microsoft. One of the most well-resourced security organizations on the planet. If it can happen there, it can happen to your
The Breach That Started With a Single Stolen Identity In 2023, a midsize accounting firm in the Midwest lost access to its entire client database — not because of a sophisticated zero-day exploit, but because a threat actor used a partner's stolen credentials purchased on the dark web. The
