Focuses on safeguarding personal and organizational identities from cyber threats such as phishing, data breaches, and credential harvesting. Articles provide practical steps for monitoring exposure, reducing digital footprints, and responding to identity compromise incidents.
posts
In 2023, a single reused password gave a threat actor access to 23andMe's credential-stuffing attack that exposed the data of nearly 7 million users. The attacker didn't exploit a zero-day vulnerability or deploy sophisticated malware. They just tried stolen passwords from other breaches — and millions of
The Breach That Started With One Reused Password In 2022, a single employee at LastPass reused credentials across personal and work accounts. A threat actor exploited that overlap, eventually compromising encrypted password vaults for millions of users. The irony — a password management company breached because of poor password hygiene — should
Your Old AIM Email Is a Bigger Threat Than You Think In December 2017, AOL officially shut down AIM — AOL Instant Messenger — after two decades as one of the internet's most iconic platforms. But here's what most people missed: the email addresses tied to those accounts
The Breach That Started With a Single Reused Password In September 2023, MGM Resorts International lost an estimated $100 million after a threat actor social-engineered their way into systems — and weak credential hygiene played a central role. That incident didn't start with a sophisticated zero-day exploit. It started
In May 2024, the FBI and international partners seized BreachForums — one of the largest marketplaces where stolen credentials on the dark web were bought and sold in bulk. The forum had facilitated the sale of billions of compromised records, including credentials tied to U.S. government agencies, healthcare organizations, and
Microsoft's security team reported that accounts protected by multi-factor authentication block over 99.9% of automated attacks. Yet according to the FBI's Internet Crime Complaint Center (IC3), credential theft and account compromise remain among the top reported cybercrime categories year after year. The gap between what
In 2019, Microsoft published a study that changed how I talk to every client about security: enabling multi-factor authentication blocks 99.9% of automated account compromise attacks. That single stat should end every debate about whether two-factor authentication benefits are worth the minor inconvenience. Yet here we are in 2026,
