Delivers actionable advice on recognizing and preventing phishing attacks, including email phishing, spear phishing, smishing, and vishing. Covers detection techniques, employee training approaches, email security tools, and real-world phishing examples to strengthen your defenses.
posts
The Breach That Started With "Company123!" In September 2023, MGM Resorts lost an estimated $100 million after a threat actor used social engineering to compromise employee credentials. The attack didn't require some sophisticated zero-day exploit. It started with identity — with passwords and people. And it'
In September 2023, MGM Resorts lost an estimated $100 million after a threat actor bypassed their security by socially engineering a helpdesk employee into resetting MFA credentials. Let that sink in. The company had multi-factor authentication. It still wasn't enough — because the multi-factor authentication setup and the processes
In September 2023, MGM Resorts lost an estimated $100 million after a threat actor social-engineered a help desk employee into resetting credentials — for an account that lacked robust secondary verification. One phone call. One bypassed identity check. Nine-figure damage. If you've ever wondered what is multi-factor authentication and
The 23andMe Breach Started With Recycled Passwords In October 2023, genetic testing company 23andMe confirmed that attackers accessed roughly 6.9 million user profiles. The method wasn't some exotic zero-day exploit. It was credential stuffing — threat actors took username and password combinations leaked from other breaches and simply
A Single Stolen Password Cost One Company $4.4 Million In May 2021, a threat actor used a single compromised password to shut down Colonial Pipeline — the largest fuel pipeline in the United States. The company paid a $4.4 million ransom. Gas stations across the southeastern U.S. ran
In August 2023, a single remote employee at a casino and entertainment company fell for a social engineering call. That one mistake gave threat actors the keys to MGM Resorts' entire kingdom — an attack that cost the company over $100 million in damages according to their SEC filing. The
In March 2023, the FBI's Internet Crime Complaint Center reported that business email compromise alone cost organizations $2.7 billion in 2022 — and the vast majority of those losses started with a single employee clicking, replying, or trusting the wrong message. I've reviewed dozens of incident
In 2022, a single employee at Uber received a flood of multi-factor authentication push notifications, got frustrated, and approved one. That decision gave a teenage threat actor access to Uber's internal systems, Slack, and cloud infrastructure. An acceptable use policy cybersecurity framework — one that specifically addressed MFA fatigue
The Framework That Could Have Prevented a $150 Million Mistake When Equifax disclosed its catastrophic 2017 breach affecting 147 million Americans, the postmortem was brutal. The company had failed at the most basic elements of what the NIST Cybersecurity Framework prescribes: asset inventory, patch management, and network segmentation. The FTC
In July 2023, a ransomware attack crippled the nonprofit hospital chain CommonSpirit Health, ultimately affecting over 600,000 patients and costing the organization an estimated $160 million. That's not a Fortune 500 company. That's a mission-driven organization built to serve communities — brought to its knees because
