Addresses the tactics attackers use to steal login credentials and the countermeasures organizations can deploy. Topics include multi-factor authentication, credential monitoring, dark web surveillance, secure authentication protocols, and employee awareness training.
posts
A hiring manager at a Fortune 500 company recently told me something that would make most college admissions officers uncomfortable: "I've hired analysts with no degree who outperformed candidates with a master's." That's not an argument against education — it's a
A Google Developer Nearly Lost Everything to a Fake Support Call In early 2025, a well-known Google developer publicly documented how he nearly fell for a sophisticated phishing attack targeting his Gmail account. The caller ID showed a legitimate Google phone number. The voice on the other end sounded professional,
In 2019, a Lithuanian man named Evaldas Rimasauskas pleaded guilty to stealing over $100 million from Google and Facebook — using nothing more than a series of fake email messages. He impersonated a legitimate hardware vendor, sent invoices from spoofed email addresses, and two of the most sophisticated tech companies on
We're barely halfway through 2026, and the breach disclosures are already stacking up at a pace that should alarm every executive, IT director, and business owner reading this. If you're searching for data breach examples 2026, you're probably trying to figure out what'
A Single Email Cost This Company $100 Million In 2019, Toyota Boshoku Corporation lost $37 million to a single business email compromise attack. A threat actor impersonated a senior executive and convinced a finance employee to change wire transfer details. The money vanished. That's phishing — not some abstract
The 10-Character Password That Cost a Hospital $3 Million In 2023, CommonSpirit Health disclosed a ransomware attack that disrupted operations across multiple states. Investigators traced the initial access back to compromised credentials — a password that met the organization's minimum requirements but crumbled under a credential stuffing attack. The
The 11-Billion-Record Wake-Up Call In January 2024, researchers discovered a file called "RockYou2024" containing nearly 10 billion unique plaintext passwords compiled from decades of data breaches. That's not a typo. Billions of passwords — many still in active use — sitting in a downloadable text file. If you&
In 2024, the Verizon Data Breach Investigations Report found that stolen credentials were involved in roughly 31% of all breaches over the prior decade. That number hasn't budged much. I've worked incident response cases where a single reused password — a seven-character string an employee used on
In 2024, the breach at Snowflake's customer environments didn't exploit some exotic zero-day vulnerability. Threat actors simply used stolen credentials — many of them passwords reused across services without multi-factor authentication. Over 165 organizations were impacted, including Ticketmaster and AT&T. The lesson was brutal and
The Email That Cost One Company $37 Million In 2024, a single phishing email led to a business email compromise attack against Orion SA, a Luxembourg-based metals trading company, resulting in a $60 million wire transfer to threat actor-controlled accounts. The company later recovered roughly $23 million. The email looked
