Phishing awareness articles teach readers to identify and avoid phishing attacks across email, SMS, voice calls, and social media. Content includes real-world phishing examples, red flags to watch for, reporting procedures, and tips for running phishing simulation campaigns.
posts
The $5.7 Billion Wake-Up Call You Can't Ignore In 2023, the FTC received over 5.39 million reports of fraud and identity theft, costing consumers billions. The agency didn't just collect reports — it started swinging hard at the businesses that failed to protect that data.
In February 2024, a ransomware attack on Change Healthcare — one of the largest health payment processors in the United States — disrupted claims processing for hospitals, pharmacies, and clinics across the country for weeks. UnitedHealth Group, its parent company, later confirmed that the personal health information of roughly 100 million individuals
The Industry That Can't Afford a Single Mistake In November 2023, the ransomware attack on ICBC's U.S. broker-dealer arm disrupted settlement of billions of dollars in Treasury trades. The largest bank in the world — by assets — was reduced to sending trade settlement data via USB
The Breach That Cost a Charity Its Reputation — and Its Donors In 2023, the nonprofit organization Save the Children Federation confirmed it was hit by the BianLian ransomware group, which claimed to have stolen nearly 7 GB of data including financial records, personal information, and medical data. A global charity
The Misconfigured Bucket That Exposed 540 Million Records In 2019, researchers at UpGuard discovered that Facebook user data — over 540 million records — sat exposed on misconfigured Amazon S3 buckets maintained by third-party app developers. Nobody hacked anything. Nobody exploited a zero-day. The data was simply left open to the public
The Text Message That Cost One Company $40 Million In 2024, a sophisticated smishing campaign targeted employees at several major financial institutions. Threat actors sent SMS messages impersonating IT support, directing staff to fake login portals that harvested credentials and multi-factor authentication tokens. The attackers then used those stolen credentials
In March 2024, a finance director at a mid-size logistics company received a text message that appeared to come from the CEO. It asked for a quick wire transfer to close a vendor deal. The director tapped the link, entered credentials on what looked like the company's banking
In January 2024, a penetration tester hired by the Iowa State Court Administration was arrested for breaking into a courthouse — even though he had a signed contract to test physical security. The incident made national news and sparked a legal battle. But it also exposed something most organizations ignore: the
The SEC Made It Official — Your Board Can't Plead Ignorance Anymore In July 2023, the SEC finalized rules requiring publicly traded companies to disclose material cybersecurity incidents within four business days and to describe their board's oversight of cyber risk annually. That wasn't a
Your Employees' Passwords Are Probably Already for Sale In January 2024, researchers discovered a file called "Naz.API" circulating on dark web forums containing over 71 million unique email addresses paired with plaintext passwords — many harvested by credential-stealing malware. That's not a hypothetical. That'
