Delivers actionable advice on recognizing and preventing phishing attacks, including email phishing, spear phishing, smishing, and vishing. Covers detection techniques, employee training approaches, email security tools, and real-world phishing examples to strengthen your defenses.
posts
A Single Click Cost One Company $188 Million In 2020, Marriott disclosed its second major breach in two years — this time exposing 5.2 million guest records. The root cause? Compromised employee credentials at a franchise property. Two employees' login details were used to access data for weeks before
The Coffee Shop Breach That Cost $6.5 Million In 2024, a mid-size financial services firm discovered that a single remote employee working from a hotel lobby had their session token hijacked through a man-in-the-middle attack on the hotel's Wi-Fi. The threat actor used that access to move
In March 2024, a single compromised employee credential at Change Healthcare led to a ransomware attack that disrupted pharmacy operations across the United States for weeks. The attackers didn't kick down a digital door — they logged in. That's what account takeover looks like in practice, and
In 2024, a finance clerk at a mid-sized manufacturing firm wired $25 million to a threat actor after joining a deepfake video call where every other "participant" — including the CFO — was AI-generated. The clerk wasn't careless. She wasn't stupid. She simply hadn't
The Breach That Started With "Summer2024!" In 2024, the Verizon Data Breach Investigations Report found that stolen credentials were involved in roughly 31% of all breaches over the prior decade — and that number hasn't meaningfully dropped. I've personally investigated incidents where an entire corporate
One Click Cost MGM Resorts Over $100 Million In September 2023, a social engineering attack against MGM Resorts International shut down slot machines, hotel key cards, and reservation systems across Las Vegas. The threat actors didn't exploit a zero-day vulnerability. They called the help desk, impersonated an employee,
The Breach That Cost a 12-Person Company Everything In 2023, a small accounting firm in Sacramento lost access to every client file it had. A single employee clicked a link in a fake DocuSign email. Within four hours, ransomware had encrypted the entire network. The ransom demand was $250,000.
Your Home Computer Is a Bigger Target Than You Think In 2023, the FBI's Internet Crime Complaint Center received over 880,000 complaints with losses exceeding $12.5 billion — and a massive share of those victims were everyday people targeted through their personal machines. Not corporate networks. Not
A Single Click Cost One Hospital Chain $100 Million In 2024, Change Healthcare — one of the largest health payment processors in the U.S. — got hit with a ransomware attack that disrupted pharmacy operations across the entire country. UnitedHealth Group, its parent company, reported costs exceeding $870 million related to
The 10-Billion-Password Wake-Up Call In July 2024, a file called "RockYou2024" appeared on a popular hacking forum containing nearly 10 billion unique plaintext passwords compiled from decades of data breaches. It was the largest credential compilation ever leaked. Within weeks, threat actors were running those passwords against corporate
