Addresses the tactics attackers use to steal login credentials and the countermeasures organizations can deploy. Topics include multi-factor authentication, credential monitoring, dark web surveillance, secure authentication protocols, and employee awareness training.
posts
The Breach That Started With "Password123" In 2020, the Verizon Data Breach Investigations Report confirmed what security professionals already suspected: over 80% of hacking-related breaches involved brute force or the use of lost or stolen credentials. That's not a typo. Four out of five breaches trace
In July 2020, a 17-year-old in Florida convinced a Twitter employee to hand over internal credentials. Within hours, threat actors had hijacked 130 high-profile accounts — including those of Barack Obama, Elon Musk, and Apple — and used them to run a Bitcoin scam. The breach didn't start with a
In April 2020, the FBI's Internet Crime Complaint Center reported it was receiving between 3,000 and 4,000 cybersecurity complaints per day — a roughly 400% increase from pre-pandemic levels. The single biggest catalyst? Millions of employees suddenly working from home on networks and devices that no corporate
A Single Reused Password Cost One Company Everything In 2021, the Colonial Pipeline ransomware attack shut down fuel distribution across the U.S. East Coast. The entry point? A single compromised password on a legacy VPN account that lacked multi-factor authentication. That's not a sophisticated nation-state exploit. That&
The CEO Who Wired $47 Million to a Threat Actor In 2016, Austrian aerospace manufacturer FACC fired its CEO after the company lost €42 million (roughly $47 million) in a business email compromise attack. A threat actor impersonated the CEO via email and convinced a finance employee to wire funds
Microsoft's security team reported that accounts protected by multi-factor authentication block over 99.9% of automated attacks. Yet according to the FBI's Internet Crime Complaint Center (IC3), credential theft and account compromise remain among the top reported cybercrime categories year after year. The gap between what
The Email That Cost One Company $37 Million In 2024, the FBI's Internet Crime Complaint Center reported that business email compromise — a sophisticated form of phishing — accounted for over $2.9 billion in adjusted losses. That's not a typo. Billions. And it all starts with a
A Phone Call From "Google" That Wasn't Google at All In late 2024, a Gmail user received a phone call from what appeared to be a legitimate Google support number. The caller warned of suspicious account activity, walked them through a fake recovery process, and captured
In March 2024, a finance director at a mid-size manufacturer in Ohio received an email from what appeared to be the company CEO. The message asked for an urgent wire transfer to close a confidential acquisition. The email looked flawless — correct logo, matching font, even a convincing signature block. She
In 2023, a single spear phishing email cost MGM Resorts an estimated $100 million in losses and recovery. The attacker didn't blast out a million generic messages — they researched one employee, crafted one convincing message, and made one phone call to the help desk. That's the
