Find practical strategies for defending against social engineering attacks at both the individual and organizational level. Content covers awareness training techniques, verification protocols, policy development, and building a security-first culture that resists manipulation attempts.
posts
In May 2024, a single employee at a midsize healthcare company clicked a link in what looked like a routine Microsoft 365 password reset email. Within 72 hours, a threat actor had exfiltrated 1.4 million patient records, triggered a ransomware payload, and the organization was staring down an eight-figure
The Text Message That Cost One Company $40 Million In 2024, a sophisticated smishing campaign targeted employees at several major financial institutions. Threat actors sent SMS messages impersonating IT support, directing staff to fake login portals that harvested credentials and multi-factor authentication tokens. The attackers then used those stolen credentials
In 2023, MGM Resorts lost an estimated $100 million after a threat actor social-engineered a help desk employee with a ten-minute phone call. The attacker didn't exploit a zero-day vulnerability. They exploited a person — someone who hadn't been trained to recognize what was happening. That single
In September 2023, a teenager used a phone call to trick an MGM Resorts employee into resetting credentials. That single social engineering attack cost MGM an estimated $100 million. No malware exploit. No zero-day vulnerability. Just a convincing voice on the other end of a help desk line. If you
MGM Resorts lost an estimated $100 million in September 2023 because a threat actor called an IT help desk, impersonated an employee, and talked their way into a privileged account. No zero-day exploit. No nation-state malware. Just a phone call and a human who hadn't been trained to
In 2022, a single employee at Twilio clicked a phishing link embedded in a fake IT notification. That one click gave threat actors access to internal systems and exposed data tied to over 130 organizations. The root cause wasn't a firewall failure or a zero-day exploit — it was
In March 2021, a single employee at a water treatment plant in Oldsmar, Florida clicked through a remote access session that could have poisoned a city's water supply. The attacker gained entry through a shared TeamViewer password — no phishing email required. The incident raised a question that boardrooms
In March 2021, a mid-size law firm in Atlanta lost $2.3 million to a single wire fraud attack. The attacker spoofed the managing partner's email, requested an urgent transfer, and a paralegal complied without hesitation. When the firm investigated, they discovered their annual security awareness program consisted
Colonial Pipeline just shut down 5,500 miles of fuel infrastructure this week. One compromised password. That's all it took. While forensic details are still emerging, the early reporting points to a single set of stolen credentials — likely obtained through a social engineering attack on an employee. If
In July 2020, a 17-year-old from Florida convinced Twitter employees to hand over internal credentials. Within hours, the accounts of Barack Obama, Elon Musk, Joe Biden, and Apple were all posting Bitcoin scam messages. The attacker didn't exploit a software vulnerability. He exploited people. These social engineering examples
