Posts exploring how attackers steal usernames, passwords, and authentication tokens through phishing, keylogging, brute force attacks, and credential stuffing. Includes actionable guidance on multi-factor authentication, password managers, and monitoring for compromised credentials.
posts
A Single Misconfigured S3 Bucket Cost Capital One $80 Million Back in 2019, a former AWS employee exploited a misconfigured web application firewall to access over 100 million Capital One customer records. The bank ultimately paid an $80 million fine to the OCC. That breach didn't happen because
A Single Checkbox Left 540 Million Facebook Records Exposed Back in 2019, researchers at UpGuard discovered that two third-party Facebook app developers had stored more than 540 million user records on Amazon S3 buckets with no access restrictions. Not encrypted. Not firewalled. Just sitting there, publicly readable, because someone didn&
In January 2024, security researchers at Checkmarx uncovered a massive man in the middle attack campaign targeting the Python Package Index (PyPI), where threat actors intercepted developer credentials and injected malicious code into software supply chains. The attack went undetected for months. This wasn't some exotic nation-state operation
In early 2024, Ivanti disclosed critical vulnerabilities in its Connect Secure VPN that were already being actively exploited by threat actors — including nation-state groups. CISA issued an emergency directive ordering federal agencies to disconnect affected devices within 48 hours. If that doesn't make you rethink your VPN best
A consultant nearly lost his entire Google account — not to a sloppy spam email, but to an AI-generated voice call that sounded exactly like Google support, complete with a follow-up email from what appeared to be an official Google domain. That's the new reality. Gmail users warned about
The $55 Million Email That Fooled a CFO In 2024, the automotive parts manufacturer Scoular lost $17.2 million to a business email compromise scheme. But that wasn't even close to the record. Ubiquiti Networks lost $46.7 million. Austrian aerospace firm FACC lost $55.8 million — and
The Breach That Started With One Reused Password In 2023, a single employee at Norton LifeLock's parent company, Gen Digital, reused a personal password across multiple accounts. Attackers used credential stuffing to compromise nearly 925,000 customer accounts. One password. Nearly a million victims. If you've
Your Home Office Is Now the Attack Surface In 2023, a single remote employee at MGM Resorts answered a social engineering call from a threat actor impersonating IT support. That one interaction led to a ransomware attack that cost the company over $100 million in losses. The attacker didn'
That "Unsubscribe" Click Just Cost Someone Their Entire Network Last year, I worked with a mid-size logistics company that lost access to every file server, customer database, and email system they had. The entry point? A single spam email disguised as a shipping notification. One employee clicked an
A Single Stolen Password Cost One Company $60 Million In 2023, MGM Resorts got hit by a social engineering attack that started with a single phone call to the help desk. The threat actors impersonated an employee, reset credentials, and within hours had enough access to deploy ransomware across the
