Computer Security News and Insights
What a Phish Setlist Actually Means for Your Security Team When the band Phish takes the stage, they never play the same setlist twice. Every show is crafted for the audience. Your phishing simulation program should work the same way. A phish setlist — a curated, rotating collection of phishing attack
In 2023, the FBI dismantled a cybercriminal operation that used the Snake malware — a sophisticated keylogger that had quietly exfiltrated credentials from government networks across 50 countries for nearly two decades. Every password. Every internal message. Every classified document typed into a keyboard. That's the reality of a
Capital One Lost 100 Million Records — The Cloud Wasn't the Problem In 2019, a former AWS employee exploited a misconfigured web application firewall and exfiltrated over 100 million Capital One customer records. The cloud infrastructure worked exactly as designed. The humans configuring it didn't. That breach
In February 2024, Change Healthcare suffered a ransomware attack that exposed the protected health information of approximately 100 million Americans. The fallout wasn't just technical — it was regulatory. Congressional hearings, state attorney general investigations, and an avalanche of class-action lawsuits followed, largely because stakeholders questioned whether data breach
A 45-Minute Quiz Stopped a $3 Million Wire Fraud In 2023, a mid-size logistics company in Ohio avoided a devastating business email compromise attack — not because of their firewall, not because of their SOC team, but because an accounts payable clerk recognized a spoofed domain. She'd seen the
3.5 Million Openings and Nobody to Fill Them Cybersecurity Ventures projected 3.5 million unfilled cybersecurity positions globally by 2025, and we're still feeling that gap heading into 2026. Meanwhile, the FBI's IC3 received a record $12.5 billion in reported cybercrime losses in 2023
In January 2024, a threat actor used stolen credentials to compromise a Microsoft executive's email account — no malware, no zero-day exploit, just a password spray attack against a legacy test tenant that lacked multi-factor authentication. Microsoft disclosed the breach publicly, and it became one of the most talked-about
The Breach That Proved "Trust But Verify" Was a Lie In 2020, a threat actor compromised SolarWinds' Orion software update mechanism and silently infiltrated over 18,000 organizations — including multiple U.S. federal agencies and Fortune 500 companies. The attackers didn't blast through firewalls. They
Your Employees' Credentials Are Already for Sale In March 2024, AT&T confirmed that data from approximately 73 million current and former customers appeared on the dark web. That breach didn't happen overnight — the data had been circulating in underground markets for years before anyone noticed.
In March 2024, a threat actor compromised a senior executive's email at a mid-size financial firm. The attacker didn't exploit a zero-day vulnerability or deploy sophisticated malware. They simply logged in with a stolen password purchased on a dark web marketplace for less than ten dollars.
