Blog
The Execution
The cybersecurity industry has spent decades and trillions of dollars building tools that operate after the fact.
Detect the breach. Respond to the incident. Recover the systems. Investigate the fraud.
Every one of those disciplines assumes the damage has already occurred and the goal is to limit it. Below, we examine what that assumption costs: real breaches, real losses, real organisations that did everything the industry told them to do and still lost. The question running through every post is the same: at the moment the consequential action executed, where was the human who should have stopped it?
How did investigating 583 stolen logins at Sakura Internet uncover a door into 1.36 million more accounts?
Japanese cloud and data centre provider Sakura Internet was investigating a breach of 583 accounts on its Rental Server service when it found something far larger. Hackers had also accessed the company's internal sales management system, the one holding contract and membership data for its customer base. Up to 1,360,563 accounts may have been exposed. Sakura says no data exfiltration has been confirmed and no ransom was demanded, but the access itself already happened.
Read articleThe vished password that turned 1.6 million RingCentral accounts into a vishing kit.
ShinyHunters voice-phished a single RingCentral employee out of their password in July 2026, then walked away with 623 gigabytes of customer data. RingCentral refused to pay, and on 3 August the group published a 280-gigabyte archive covering roughly 1.6 million accounts, complete with names, phone numbers and physical addresses. That is not just a breach. It is a targeting list for the next vishing campaign, built from the same trust RingCentral sells to more than 600,000 businesses.
Read articleApollo Global Management manages $938 billion. It could not tell a spoofed phone call from a real one.
Apollo Global Management confirmed on 21 August that hackers stole employee data during a social engineering attack between 6 and 10 July 2026. The attackers called staff on personal phones, posed as internal IT help desk workers, and in some cases spoofed the company's genuine help desk number. Employees who engaged were directed to fake login pages built to capture passwords and multi-factor authentication codes. Apollo is one of at least half a dozen private equity giants targeted by the same campaign this summer.
Read articleAn AI agent cracked 85 Taiwanese government logins in four days. Nobody approved a single one.
Israeli security researchers at Dream have documented what they describe as the first publicly known autonomous AI attack against a government target. Between 1 and 4 July 2026, AI agents built on open-source frameworks compromised 85 accounts inside Taiwan's government, extracted more than 2,500 personnel records, and expanded on their own initiative into a nuclear safety agency, government email systems, and energy sector suppliers. No human operator directed which system got hit next. Researchers say the operational documentation points to a Chinese-language operator; Taiwan's government has not publicly confirmed the intrusion.
Read articleMcDonald's, Vodafone and seven other Fortune 500 companies had MFA enabled. None of it stopped a stolen session cookie.
A threat actor using the alias TheHatman has spent the past week selling what it claims are Microsoft Azure and Entra directory exports stolen from nine Fortune 500 companies, including McDonald's, Vodafone, Tata Consultancy Services and Gap Inc. The listings claim more than 3.6 million records combined: employee names, job titles, phone numbers, department structures and, in some cases, Global Administrator account listings. TCS and Vodafone say the data is years old and does not reflect a live compromise of their systems. TheHatman claims otherwise, and says the access came from password spraying and MFA fatigue, not a stolen password alone.
Read articleThe CareCloud breach grew tenfold in five months. Nobody has said how attackers got in.
CareCloud, the electronic health records giant that stores medical data for tens of thousands of healthcare providers, told state regulators in July that a March intrusion had affected roughly 350,000 patients. This week, the federal government's own healthcare breach tracker put the real number at 3,756,469. Names, Social Security numbers, financial accounts and medical records were exposed. Five months after the intrusion, CareCloud still has not said how the attackers got in.
Read articleHow did stolen credentials and a bypassed MFA prompt reach 678,000 French taxpayers?
France's tax authority, the Direction Générale des Finances Publiques (DGFiP), has confirmed that an intruder extracted tax and property data belonging to 678,000 individuals and businesses. The attacker, using the alias ZeroBytes, claims the access came from stolen login credentials and a technique for bypassing multi-factor authentication, not a technical exploit. DGFiP's own monitoring did not catch the theft when it happened; investigators only established the scale of what had been taken after the stolen database surfaced for sale on a cybercrime forum. The data is already on offer to the highest bidder.
Read articleWhy did the access controls at France's tax authority miss the theft of 678,000 taxpayer records?
A hacker using the alias ZeroBytes claims to have accessed systems inside France's tax authority using a stolen login and a multi-factor authentication bypass technique. When investigators first reviewed the affected accounts, they found no evidence that data had been taken. Only a deeper investigation, opened after ZeroBytes advertised a stolen database for sale, established that 678,000 individuals and businesses had their tax and property records extracted. The review built to catch exactly this looked, and saw nothing.
Read articleNobody confirmed the payroll export a Brightly Software contractor later held for $2.5 million ransom.
Cameron Curry, a data analyst contractor at Brightly Software, spent his six-month assignment quietly copying payroll and employee data out of the company's systems. Nobody asked him to justify the export, and nobody had to approve it. When his contract ended in December 2023, he used the stolen files to demand $2.5 million in cryptocurrency. Brightly paid him $7,540 before the FBI closed in.
Read articleNo password was stolen. Wesco's CRM handed over 2.6 million records anyway.
The extortion group ExfilSquad claims it pulled 2.6 million records out of Wesco International's cloud CRM environment without stealing a single password. Wesco has confirmed the incident and found no ransomware, no malware, and no compromised credentials anywhere in its investigation. The data, the group says, left through a public-facing data table nobody had locked down. ExfilSquad published it after the ransom deadline passed.
Read articleBlog content generation is AI assisted.