Computer Security News and Insights
In April 2022, researchers at Tsinghua University and the University of California disclosed a new class of DNS cache poisoning vulnerabilities affecting major DNS software. The attack, dubbed "MaginotDNS," could redirect users from legitimate banking and email sites to pixel-perfect phishing pages — and the victims never saw a
In February 2024, Change Healthcare — one of the largest health payment processors in the U.S. — was hit by a ransomware attack that disrupted claims processing for thousands of hospitals, pharmacies, and clinics nationwide. UnitedHealth Group, its parent company, later confirmed the breach affected roughly 100 million individuals. The company
23andMe Lost Everything — Starting with Recycled Passwords In October 2023, genetic testing company 23andMe confirmed that a credential stuffing attack compromised roughly 6.9 million user accounts. Attackers didn't exploit a zero-day vulnerability or deploy sophisticated malware. They simply took usernames and passwords stolen from other breaches and
The Breach That Came From the Corner Office In 2022, a former Pfizer employee downloaded over 12,000 files — including trade secrets and COVID-19 vaccine data — to a personal Google Drive account before jumping to a competitor. The company didn't catch it until weeks later. No external hacker.
In 2023, the FBI's Internet Crime Complaint Center reported over $12.5 billion in losses from cybercrime — and a staggering percentage of those incidents started with a single piece of software pretending to be something it wasn't. Trojan horse malware remains one of the most effective
In 2023, the FBI's Internet Crime Complaint Center received over 298,000 phishing complaints — making it the most reported cybercrime category for the fifth consecutive year. I've investigated phishing incidents at organizations of every size, from ten-person startups to Fortune 500 companies. The pattern is always
In January 2024, researchers discovered a file called "Naz.API" circulating on dark web forums. It contained over 70 million unique email addresses and their associated passwords — harvested from credential-stealing malware installed on everyday computers. Most of the victims had no idea their login information was for sale.
In 2023, MGM Resorts had a multi-billion dollar security stack — endpoint detection, firewalls, SIEM platforms, the works. A single social engineering phone call bypassed all of it. The attackers impersonated an employee, convinced the IT help desk to reset credentials, and caused an estimated $100 million in damages. If you
The Breach That Started With a Forgotten SaaS App In 2023, a Salesforce misconfiguration exposed sensitive data at multiple government agencies and financial institutions. The root cause wasn't sophisticated malware or a zero-day exploit. It was a permissions setting that nobody reviewed after initial deployment. That single oversight
In March 2024, the FBI's IC3 reported that Americans lost over $45 million to smishing and vishing schemes in a single year — and those are just the cases people actually reported. I've personally investigated incidents where a single SMS message led to a six-figure wire transfer
