Resources and best practices for designing and delivering effective security awareness training programs. Covers phishing simulations, compliance requirements, behavior change techniques, measuring training effectiveness, and fostering a culture of vigilance across organizations.
posts
In May 2021, a single phishing email led to the shutdown of Colonial Pipeline — the largest fuel pipeline in the United States. The attackers used compromised credentials, likely harvested through a phishing campaign, to deploy ransomware that disrupted fuel supply across the entire East Coast. That one email triggered panic
The FBI Keeps Warning About Gmail — And Most People Keep Ignoring It In 2020, the FBI's Internet Crime Complaint Center (IC3) received 791,790 complaints — a 69% increase from 2019. A staggering number of those complaints involved business email compromise, phishing, and credential theft targeting popular email platforms.
The Colonial Pipeline Attack Changed Everything On May 7, 2021, a single compromised password shut down the largest fuel pipeline in the United States. Colonial Pipeline paid a $4.4 million ransom to the DarkSide threat actor group — and Americans along the East Coast panic-bought gasoline for days. That'
The Colonial Pipeline Hack Changed the Conversation On May 7, 2021, a single compromised password shut down the largest fuel pipeline in the United States. Colonial Pipeline paid a $4.4 million ransom in Bitcoin to the DarkSide ransomware group. Gas stations across the Southeast ran dry. Panic buying erupted.
The Colonial Pipeline Hack Was a Wake-Up Call Nobody Should Have Needed On May 7, 2021, a single compromised password shut down the largest fuel pipeline in the United States. Colonial Pipeline paid a $4.4 million ransom to the DarkSide threat actor group, and fuel shortages rippled across the
The Colonial Pipeline Just Proved Your Software Isn't Enough On May 7, 2021, a single compromised password shut down the largest fuel pipeline in the United States. Colonial Pipeline's systems went dark, gasoline shortages spread across the Southeast, and a ransomware gang called DarkSide walked away
The Colonial Pipeline Attack Started with a Single Compromised Credential As I write this, Colonial Pipeline is still scrambling to restore fuel delivery to the southeastern United States after a ransomware attack that shut down 5,500 miles of pipeline. The FBI confirmed DarkSide as the threat actor. While the
In July 2020, a 17-year-old in Florida convinced a Twitter employee to hand over internal credentials. Within hours, the attacker hijacked accounts belonging to Barack Obama, Elon Musk, and Apple — tweeting a Bitcoin scam to millions. The breach didn't start with a sophisticated exploit or zero-day vulnerability. It
One Phish Email Took Down a $60 Billion Company's Defenses In 2023, MGM Resorts International lost roughly $100 million after a social engineering attack that started with a single phone call to their help desk. But most attacks don't even require that much effort. The average
In 2023, MGM Resorts lost roughly $100 million after a threat actor called a help desk, impersonated an employee found on LinkedIn, and talked their way past security controls. No zero-day exploit. No nation-state malware. Just a phone call. That incident crystallized something I've been telling organizations for
