Computer Security News and Insights
A USB Drive in the Parking Lot Changed Everything In 2023, the Department of Homeland Security ran a test. They scattered USB drives in the parking lots of government buildings and private contractors. Forty-eight percent of the people who picked them up plugged them into a work computer. Nearly all
One Stolen Password Cost Colonial Pipeline $4.4 Million In May 2021, a single compromised password — used on a legacy VPN account without two-factor authentication — gave a threat actor access to Colonial Pipeline's network. The ransomware attack shut down fuel delivery across the U.S. East Coast. The
A Billion Records Exposed Because Someone Skipped the Basics In 2024, the National Public Data breach exposed an estimated 2.9 billion records — Social Security numbers, addresses, phone numbers — all because basic security controls failed. Not a sophisticated zero-day exploit. Not a nation-state attack. Just poor fundamentals. That's
One Click Cost MGM Resorts $100 Million In September 2023, a threat actor called Scattered Spider called MGM Resorts' IT help desk, impersonated an employee, and gained access to internal systems. The result? Over $100 million in losses, days of disrupted operations, and a data breach affecting millions of
A financial analyst at a Fortune 500 company typed her corporate credentials into a laptop at Chicago O'Hare. The man sitting two seats behind her wasn't reading the news on his phone — he was recording her screen. Within 48 hours, the attacker used those stolen credentials
One Phishing Email Cost This Company $100 Million In 2023, MGM Resorts was brought to its knees — not by a sophisticated zero-day exploit, but by a phishing email and a follow-up phone call. Threat actors from the Scattered Spider group used social engineering to trick an IT help desk employee,
In March 2024, a threat actor breached a major healthcare provider's network using a single compromised password — no second factor required. The organization had purchased MFA licenses two years prior but never enforced enrollment. That gap cost them months of remediation and exposed the records of over 100,
In January 2024, the SEC's official X (formerly Twitter) account was hijacked after a threat actor convinced a mobile carrier to transfer the agency's phone number to a new SIM card. The attacker used SMS verification codes to reset the password and post a fake announcement
In 2023, a single MOVEit vulnerability gave threat actors access to data from over 2,500 organizations — and financial institutions were among the hardest hit. Banks, credit unions, wealth management firms, and insurance companies collectively reported hundreds of millions of compromised records. If you work in finance, you already know
In 2023, the FBI's Internet Crime Complaint Center received over 880,000 complaints with potential losses exceeding $12.5 billion — a 22% increase in losses over the previous year. And those are just the incidents that were actually reported. In my experience, for every cyber incident that gets
