Explores strategies and best practices for preventing data breaches in organizations of all sizes. Covers topics like access controls, encryption, network monitoring, incident response planning, and employee awareness to help reduce the risk of unauthorized data exposure.
posts
In January 2024, a finance employee at a multinational engineering firm in Hong Kong wired $25 million to threat actors after a video call with what appeared to be the company's CFO. The call was a deepfake. But the attack started weeks earlier — with a single spear phishing
In 2019, a Lithuanian national named Evaldas Rimasauskas pleaded guilty to stealing over $120 million from Google and Facebook using a sophisticated man in the middle attack scheme. He impersonated a legitimate hardware vendor, intercepted invoice communications, and redirected payments to bank accounts he controlled. The scheme ran for two
The Breach That Started With a Single Click In 2023, MGM Resorts lost an estimated $100 million after a threat actor called Scattered Spider social-engineered a help desk employee with a ten-minute phone call. The attacker didn't exploit a zero-day vulnerability. They didn't crack an encryption
The 6-Character Password That Cost a Company $4.88 Million IBM's 2024 Cost of a Data Breach Report pegged the global average breach cost at $4.88 million. In my experience analyzing post-breach forensics, weak or reused passwords remain the single most common entry point for threat actors.
In 2023, a financial services employee signed up for an unsanctioned file-sharing app using their corporate email. Within weeks, a threat actor exploited a vulnerability in that app and exfiltrated 11,000 customer records. The security team didn't even know the app existed. That's shadow IT
In 2023, MGM Resorts lost roughly $100 million after a threat actor called Scattered Spider social-engineered the company's IT help desk with a single phone call. The attacker impersonated an employee, convinced the help desk to reset credentials, and within hours had burrowed deep enough to deploy ransomware
In November 2023, the international law firm Allen & Overy confirmed it was hit by a LockBit ransomware attack. Weeks earlier, a midsize firm in the southeastern U.S. paid a seven-figure ransom after a threat actor encrypted every client file on its network — and the firm never made headlines
The SEC Fired the Starting Gun — Most Boards Still Haven't Moved In late 2023, the SEC's new cybersecurity disclosure rules forced publicly traded companies to report material cyber incidents within four business days. Suddenly, board directors who had spent decades delegating "the tech stuff"
In 2024, the FBI's Internet Crime Complaint Center received over 859,000 complaints with losses exceeding $16.6 billion — a 33% increase from the year before. That number isn't slowing down in 2026. I've spent years watching organizations and individuals make the same preventable
A 20-Year-Old Exploit Still Topping the Charts In 2023, the MOVEit Transfer vulnerability — a SQL injection flaw — led to the compromise of over 2,600 organizations and roughly 90 million individuals' records. One vulnerability. One technique that's been publicly documented since the early 2000s. And it still
