Details the techniques attackers use to hijack user accounts and the defensive measures that stop them. Topics include credential stuffing defenses, anomalous login detection, session management, and incident response steps for compromised accounts.
posts
A Single Stolen Password Cost This Company $60 Million In 2023, MGM Resorts International was brought to its knees — not by a sophisticated zero-day exploit, but by a phone call. A threat actor called the help desk, impersonated an employee found on LinkedIn, and gained access to internal systems. The
23andMe Filed for Bankruptcy. Account Takeover Was the Starting Gun. In October 2023, genetic testing company 23andMe confirmed that threat actors had compromised roughly 6.9 million user accounts. The attack method wasn't some exotic zero-day exploit. It was credential stuffing — attackers used previously leaked username and password
That Gmail Alert Isn't Always What You Think In September 2023, the FBI's Internet Crime Complaint Center warned that business email compromise — much of it involving compromised Gmail and Google Workspace accounts — resulted in over $2.9 billion in reported losses during 2023 alone. A single
In January 2021, the FBI's Internet Crime Complaint Center reported that business email compromise — a form of account takeover — cost victims over $1.8 billion in 2020 alone. That made it the costliest category of cybercrime by a wide margin. Not ransomware. Not credit card fraud. Account takeover.
In January 2024, a threat actor used credential stuffing to compromise a test environment at Microsoft — and then pivoted to access senior leadership email accounts for weeks before detection. Microsoft. One of the most well-resourced security organizations on the planet. If it can happen there, it can happen to your
A Single Stolen Password Cost One Company $60 Million In 2023, MGM Resorts lost an estimated $100 million after a threat actor used social engineering to take over an employee's account through a help desk call. The attackers didn't hack a firewall. They didn't
