Addresses the tactics attackers use to steal login credentials and the countermeasures organizations can deploy. Topics include multi-factor authentication, credential monitoring, dark web surveillance, secure authentication protocols, and employee awareness training.
posts
Your Home Office Is a Threat Actor's Favorite Target In 2023, a single remote employee at MGM Resorts answered a social engineering call that led to a ransomware attack costing the company over $100 million. The attacker didn't breach a firewall. They didn't exploit
One Stolen Password Cost Colonial Pipeline $4.4 Million In May 2021, a single compromised password — used on a legacy VPN account without two-factor authentication — gave a threat actor access to Colonial Pipeline's network. The ransomware attack shut down fuel delivery across the U.S. East Coast. The
In March 2024, a threat actor breached a major healthcare provider's network using a single compromised password — no second factor required. The organization had purchased MFA licenses two years prior but never enforced enrollment. That gap cost them months of remediation and exposed the records of over 100,
In January 2024, the SEC's official X (formerly Twitter) account was hijacked after a threat actor convinced a mobile carrier to transfer the agency's phone number to a new SIM card. The attacker used SMS verification codes to reset the password and post a fake announcement
A hiring manager at a Fortune 500 company recently told me something that would make most college admissions officers uncomfortable: "I've hired analysts with no degree who outperformed candidates with a master's." That's not an argument against education — it's a
A Google Developer Nearly Lost Everything to a Fake Support Call In early 2025, a well-known Google developer publicly documented how he nearly fell for a sophisticated phishing attack targeting his Gmail account. The caller ID showed a legitimate Google phone number. The voice on the other end sounded professional,
In 2019, a Lithuanian man named Evaldas Rimasauskas pleaded guilty to stealing over $100 million from Google and Facebook — using nothing more than a series of fake email messages. He impersonated a legitimate hardware vendor, sent invoices from spoofed email addresses, and two of the most sophisticated tech companies on
We're barely halfway through 2026, and the breach disclosures are already stacking up at a pace that should alarm every executive, IT director, and business owner reading this. If you're searching for data breach examples 2026, you're probably trying to figure out what'
A Single Email Cost This Company $100 Million In 2019, Toyota Boshoku Corporation lost $37 million to a single business email compromise attack. A threat actor impersonated a senior executive and convinced a finance employee to change wire transfer details. The money vanished. That's phishing — not some abstract
The 10-Character Password That Cost a Hospital $3 Million In 2023, CommonSpirit Health disclosed a ransomware attack that disrupted operations across multiple states. Investigators traced the initial access back to compromised credentials — a password that met the organization's minimum requirements but crumbled under a credential stuffing attack. The
