Addresses the tactics attackers use to steal login credentials and the countermeasures organizations can deploy. Topics include multi-factor authentication, credential monitoring, dark web surveillance, secure authentication protocols, and employee awareness training.
posts
In September 2023, MGM Resorts lost an estimated $100 million after a threat actor bypassed their security by socially engineering a helpdesk employee into resetting MFA credentials. Let that sink in. The company had multi-factor authentication. It still wasn't enough — because the multi-factor authentication setup and the processes
The Password That Cost One Company $4.4 Billion In 2017, Equifax suffered a breach that exposed 147 million records and eventually cost the company over $4 billion in total losses and settlements. One of the contributing factors? Weak internal credential management. The admin username and password for a critical
Your Remote Workforce Is Your Largest Attack Surface In March 2023, the FBI's Internet Crime Complaint Center (IC3) reported that losses from cybercrime exceeded $10.3 billion in 2022 — a 49% increase from the year before. A massive chunk of those losses traced back to compromised remote workers.
The Industry That Gets Hit Hardest — and Most Often In January 2023, ION Trading Technologies — a critical software vendor serving derivatives traders worldwide — got hit with a LockBit ransomware attack that forced dozens of financial institutions back to manual trade processing. For days. In one of the most automated industries
In January 2022, a European subsidiary of the Japanese manufacturer Nikkei lost $29 million after a single employee followed wire transfer instructions from a fraudulent email that impersonated a senior executive. That wasn't a failure of firewalls or endpoint detection. It was a surgical, well-researched executive phishing attack
In March 2022, Lapsus$ breached Okta, Microsoft, and Nvidia — three companies with enormous security budgets — partly by exploiting weak or absent multi-factor authentication. The attackers used social engineering, SIM swapping, and MFA fatigue attacks to bypass single-layer defenses. Had stronger two-factor authentication been uniformly enforced, several of those breaches could
In February 2022, a teenage hacker tricked a T-Mobile employee into performing a SIM swap, then used that hijacked phone number to intercept SMS verification codes and breach Lapsus$ targets including Nvidia and Microsoft. The attack wasn't sophisticated. It didn't require zero-day exploits. The threat actor
Why Every Security Team Needs a Phish Setlist In March 2022, Okta confirmed that the Lapsus$ threat actor group breached a third-party support engineer's account — and a big part of that attack chain started with social engineering. A single compromised credential. One phishing message that worked. That'
One Clicked Link Cost This Company Everything In September 2022, a single employee at Uber clicked a link in a social engineering attack. The threat actor, reportedly affiliated with Lapsus$, used that foothold to access internal systems, Slack channels, and cloud infrastructure. The breach made global headlines — not because Uber&
In March 2022, the FBI's Internet Crime Complaint Center reported that phishing schemes were the most common cybercrime in 2021, with over 323,000 victims — more than double the count from 2019. That number is climbing again in 2022. If you're searching for how to spot
