Computer Security News and Insights
A Preventable Breach That Started With One Reused Password In 2024, the breach at Change Healthcare disrupted pharmacy operations across the United States for weeks. The root cause? A compromised credential on a system that lacked multi-factor authentication. That single gap — a basic cyber hygiene failure — led to one of
A Stolen Password, a $4.88 Million Problem In 2024, IBM's Cost of a Data Breach Report pegged the global average breach cost at $4.88 million — the highest figure ever recorded. The root cause in most of those incidents wasn't a sophisticated zero-day exploit. It
In 2023, MGM Resorts lost an estimated $100 million after a social engineering attack that started with a single phone call to a help desk. The attackers didn't exploit a zero-day vulnerability. They didn't write exotic malware. They called IT support, impersonated an employee, and got
The CEO Who Clicked the Link In 2024, the SEC charged SolarWinds' CISO with fraud and internal control failures tied to the massive breach that compromised federal agencies and Fortune 500 companies. That case sent shockwaves through every boardroom in America — not because of the technical details, but because
The SEC Changed Everything — Most Boards Still Haven't Caught Up In July 2023, the SEC adopted rules requiring public companies to disclose material cybersecurity incidents within four business days and to describe their board's oversight of cyber risk annually. Since then, I've reviewed dozens
A Single Email Cost This Company $47 Million In 2015, Ubiquiti Networks disclosed that threat actors used a CEO fraud email scam to trick finance employees into wiring $46.7 million to overseas accounts controlled by attackers. The emails looked like routine requests from senior executives. No malware was involved.
The CEO Who Wired $47 Million to a Threat Actor In 2016, Austrian aerospace manufacturer FACC lost €42 million (roughly $47 million) after attackers impersonated the company's CEO via email and convinced an employee in the finance department to transfer funds for a fake acquisition project. The CEO
In December 2020, security firm FireEye disclosed that threat actors had compromised SolarWinds' Orion software platform — and with it, roughly 18,000 organizations that installed a poisoned update. Government agencies, Fortune 500 companies, and critical infrastructure operators all got hit through a single trusted vendor. That's the
The Breach That Didn't Start With You In 2023, the MOVEit Transfer vulnerability didn't just hit one company. It cascaded through thousands of organizations that relied on a single file-transfer vendor. Government agencies, banks, healthcare systems, and universities all found themselves exposed — not because of anything
The Breach That Didn't Start With You In 2023, the MOVEit Transfer vulnerability compromised over 2,600 organizations and exposed the data of more than 77 million individuals — not because those organizations had weak security, but because a single vendor did. Companies like Ernst & Young, the BBC,
