Computer Security News and Insights
In January 2024, a threat actor used stolen credentials to compromise a Microsoft executive's email account — no malware, no zero-day exploit, just a password spray attack against a legacy test tenant that lacked multi-factor authentication. Microsoft disclosed the breach publicly, and it became one of the most talked-about
The Breach That Proved "Trust But Verify" Was a Lie In 2020, a threat actor compromised SolarWinds' Orion software update mechanism and silently infiltrated over 18,000 organizations — including multiple U.S. federal agencies and Fortune 500 companies. The attackers didn't blast through firewalls. They
Your Employees' Credentials Are Already for Sale In March 2024, AT&T confirmed that data from approximately 73 million current and former customers appeared on the dark web. That breach didn't happen overnight — the data had been circulating in underground markets for years before anyone noticed.
In March 2024, a threat actor compromised a senior executive's email at a mid-size financial firm. The attacker didn't exploit a zero-day vulnerability or deploy sophisticated malware. They simply logged in with a stolen password purchased on a dark web marketplace for less than ten dollars.
The Phishing Email That Came From PayPal's Own Servers In late 2024, security researchers at Avanan documented a campaign where threat actors sent phishing invoices through PayPal's actual invoicing system — meaning the emails passed SPF, DKIM, and DMARC checks flawlessly. The same tactic has since merged
In early 2024, a breach at Change Healthcare — a subsidiary of UnitedHealth Group — crippled pharmacies and hospitals across the United States for weeks. The attack didn't start at a hospital. It started at a third party vendor. A single set of compromised credentials on a system without multi-factor
A $4.88 Million Average — and a Framework Most Organizations Ignore IBM's 2024 Cost of a Data Breach Report pegged the global average at $4.88 million per incident. That's a record. Yet when I ask mid-size companies whether they've implemented any NIST standards,
In 2022, a former employee at Cash App's parent company, Block, downloaded reports containing the personal information of 8.2 million customers — months after they'd left the company. Their access had never been revoked. That single oversight triggered SEC filings, lawsuits, and reputational damage that took
The Receptionist Who Handed Over the Keys to the Kingdom In 2023, MGM Resorts lost an estimated $100 million after a threat actor called the help desk, impersonated an employee found on LinkedIn, and convinced a staff member to reset credentials. No code was written. No zero-day exploit was deployed.
A 60% Click Rate That Should Have Been a Wake-Up Call I ran a phishing simulation training exercise for a mid-size logistics company last year. The first campaign used a fake Microsoft 365 password reset email — nothing fancy, no zero-day exploit, just a convincing lure. Sixty percent of employees clicked.
