Discover resources and strategies for building effective security awareness training programs. Posts cover curriculum design, engagement techniques, compliance requirements, and methods for measuring training impact to reduce human-related security incidents across organizations.
posts
In October 2024, the FTC finalized a settlement with Marriott International and its subsidiary Starwood Hotels over data breaches that exposed the personal information of 344 million customers. Among the FTC's requirements: Marriott had to implement a comprehensive information security program — including mandatory employee training. That wasn'
The Framework Nobody Reads — Until After the Breach In February 2024, Change Healthcare suffered a ransomware attack that disrupted pharmacy operations across the United States for weeks. UnitedHealth Group eventually disclosed that the breach affected roughly 100 million individuals — making it one of the largest healthcare data breaches in history.
The $5.7 Billion Wake-Up Call You Can't Ignore In 2023, the FTC received over 5.39 million reports of fraud and identity theft, costing consumers billions. The agency didn't just collect reports — it started swinging hard at the businesses that failed to protect that data.
In February 2024, a ransomware attack on Change Healthcare — one of the largest health payment processors in the United States — disrupted claims processing for hospitals, pharmacies, and clinics across the country for weeks. UnitedHealth Group, its parent company, later confirmed that the personal health information of roughly 100 million individuals
The Industry That Can't Afford a Single Mistake In November 2023, the ransomware attack on ICBC's U.S. broker-dealer arm disrupted settlement of billions of dollars in Treasury trades. The largest bank in the world — by assets — was reduced to sending trade settlement data via USB
The Breach That Cost a Charity Its Reputation — and Its Donors In 2023, the nonprofit organization Save the Children Federation confirmed it was hit by the BianLian ransomware group, which claimed to have stolen nearly 7 GB of data including financial records, personal information, and medical data. A global charity
A Single Misconfigured S3 Bucket Exposed 3 Billion Records In 2021, a researcher discovered that a misconfigured cloud storage bucket belonging to data analytics firm Cognyte had exposed more than five billion records. Capital One's infamous 2019 breach — a misconfigured web application firewall in AWS — cost them over
The Misconfigured Bucket That Exposed 540 Million Records In 2019, researchers at UpGuard discovered that Facebook user data — over 540 million records — sat exposed on misconfigured Amazon S3 buckets maintained by third-party app developers. Nobody hacked anything. Nobody exploited a zero-day. The data was simply left open to the public
The Snowflake Breach Changed How I Think About Cloud Risk In mid-2024, threat actors compromised over 165 organizations by exploiting stolen credentials against Snowflake cloud accounts that lacked multi-factor authentication. Ticketmaster, AT&T, Santander — massive names, massive data losses. The root cause wasn't some exotic zero-day. It
In January 2025, the Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive after threat actors exploited misconfigured SaaS environments across multiple federal agencies. The attackers didn't need sophisticated zero-day exploits. They walked in through overprivileged service accounts, dormant API tokens, and single-factor authentication — problems that every
