Discover resources and strategies for building effective security awareness training programs. Posts cover curriculum design, engagement techniques, compliance requirements, and methods for measuring training impact to reduce human-related security incidents across organizations.
posts
A Single Fraud Ring Stole $6 Million Before Anyone Noticed In 2023, the FBI's IC3 received over 880,000 cybercrime complaints with losses exceeding $12.5 billion — a 22% increase from the prior year. A growing share of those losses came from coordinated fraud operations, not lone hackers
In February 2024, Change Healthcare — a subsidiary processing roughly one-third of all U.S. medical claims — was hit by the ALPHV/BlackCat ransomware group. The attack disrupted pharmacy operations nationwide for weeks, cost UnitedHealth Group an estimated $872 million in the first quarter alone, and exposed the personal health data
In 2023, the FBI's Internet Crime Complaint Center reported that business email compromise — the category that includes fakeemail schemes — caused over $2.9 billion in adjusted losses across roughly 21,489 complaints. That made it the single most financially damaging cybercrime category in the IC3's annual
In 2023, a single spear phishing email cost MGM Resorts an estimated $100 million in losses. The attacker didn't blast a million inboxes with a generic "Your account has been suspended" message. They researched an employee on LinkedIn, called the IT help desk impersonating that person,
A Teenager Breached Uber. No Malware Required. In September 2022, an 18-year-old compromised Uber's internal systems — not with a sophisticated zero-day exploit, but with a text message. The attacker bombarded an Uber contractor with multi-factor authentication push requests until the contractor finally approved one. From there, the threat
In late 2024, security researchers at Avanan documented a surge of phishing campaigns that weaponized legitimate DocuSign and PayPal infrastructure to deliver convincing credential theft attacks. The emails didn't come from spoofed domains. They came from the actual DocuSign and PayPal platforms — which is exactly why they sailed
The Text Message That Cost One Company $15 Million In 2022, threat actors hit Twilio with an SMS-based social engineering attack that compromised employee credentials and exposed data for over 160 customers. The attack didn't involve a sophisticated zero-day exploit. It started with a text message pretending to
Last March, a finance director at a mid-size logistics company wired $2.1 million to a threat actor who had spoofed the CEO's email address. The message looked perfect — right tone, right signature, right sense of urgency. The only thing wrong was the reply-to domain, off by a
That "Unsubscribe" Link Just Installed Malware on Your Network In January 2024, a mid-size accounting firm in Ohio lost access to every client file it had. The entry point wasn't a sophisticated zero-day exploit. It was a single spam email disguised as a shipping notification from
A Single Stolen Password Cost This Company $60 Million In 2023, MGM Resorts International was brought to its knees — not by a sophisticated zero-day exploit, but by a phone call. A threat actor called the help desk, impersonated an employee found on LinkedIn, and gained access to internal systems. The
