Content tagged here examines threats originating from within an organization, including malicious employees, negligent staff, and compromised credentials. Topics cover behavioral indicators, monitoring tools, data loss prevention, insider threat programs, and organizational policies designed to detect and mitigate risks from trusted individuals.
posts
In 2022, a former employee of Cash App's parent company, Block Inc., downloaded reports containing the personal information of 8.2 million customers — months after being terminated. The company's failure to revoke access cost them regulatory scrutiny, a class-action lawsuit, and reputational damage that no PR
In May 2022, a Yahoo research scientist named Qian Sang downloaded roughly 570,000 pages of proprietary source code to his personal devices — minutes after receiving a job offer from a competitor. Yahoo's internal systems flagged it, but only after the data had already left. That incident is
One Clicked a Link. The Other Sold the Data. Both Cost Millions. In 2023, Tesla disclosed that two former employees had leaked the personal information of over 75,000 people — including Social Security numbers — to a foreign media outlet. That same year, the Verizon 2023 Data Breach Investigations Report confirmed
In January 2024, a penetration tester hired by the Iowa State Court Administration was arrested for breaking into a courthouse — even though he had a signed contract to test physical security. The incident made national news and sparked a legal battle. But it also exposed something most organizations ignore: the
A Badge Swipe, a Smile, and a Six-Figure Data Breach In 2019, a penetration tester hired by Coalfire walked into a locked Iowa courthouse after hours — simply by following someone through a door. He and his partner were arrested, but the point was proven: physical security is often the weakest
In 2023, a healthcare organization in the Midwest lost over 2,000 patient records — not because a hacker exploited a zero-day vulnerability, but because an employee left printed patient lists on their desk over the weekend. A cleaning contractor photographed them. That's it. No malware, no phishing email,
In January 2023, a former Tesla employee leaked the personal information of over 75,000 people — names, Social Security numbers, financial records — to a foreign news outlet. Tesla confirmed the breach wasn't caused by a sophisticated threat actor or a zero-day exploit. It was an insider. If you&
Two Employees, Two Paths to a Breach In May 2023, Tesla disclosed that two former employees had leaked the personal data of over 75,000 workers — including Social Security numbers and financial records — to a German news outlet. That wasn't a sophisticated nation-state hack. It was insiders walking
The App Your Marketing Team Installed Last Tuesday Could Cost You Millions In 2022, a mid-size healthcare company discovered that an employee had been syncing patient records to a personal Dropbox account for three years. No malicious intent — they just wanted to work from home more easily. The resulting HIPAA
In 2019, a man wearing a reflective vest and carrying a clipboard walked into a secure data center in Atlanta, unplugged a server, tucked it under his arm, and walked right back out the front door. Nobody stopped him. Nobody questioned him. A $2.5 million client database left the
