Blog
The Execution
The cybersecurity industry has spent decades and trillions of dollars building tools that operate after the fact.
Detect the breach. Respond to the incident. Recover the systems. Investigate the fraud.
Every one of those disciplines assumes the damage has already occurred and the goal is to limit it. Below, we examine what that assumption costs: real breaches, real losses, real organisations that did everything the industry told them to do and still lost. The question running through every post is the same: at the moment the consequential action executed, where was the human who should have stopped it?
May 17, 2026. Three days inside DentaQuest's network. Fifteen million patients found out eight weeks later.
DentaQuest, the dental and vision benefits administrator for roughly 32 million Americans, discovered in May 2026 that ShinyHunters had spent three days inside its network. The group claimed to have taken 234 GB of data, including Social Security numbers and health records, reportedly after employees were pressured into resetting multi-factor authentication and handing over access credentials. Ransom talks failed. DentaQuest did not start mailing notification letters until eight weeks later, by which point the data was already for sale.
Read articleA vishing call convinced Brinks Home's Microsoft Entra system to accept an attacker as an employee
ShinyHunters says it talked its way into Brinks Home's Microsoft Entra environment on 13 July 2026 with a single phone call to an employee, posing as the company's own IT department. The gang claims it walked away with 4.9 million Salesforce records, including more than 3.8 million customer support chat logs and over 4,000 employee files. Brinks Home has not confirmed the vishing account, and its investigation remains open more than two weeks after the group's leak deadline passed. No systems controlling the company's physical alarm monitoring were affected.
Read articleA single unconfirmed export at Ceva Logistics reached a bank, a football club, and Steam gamers within days
Ceva Logistics, the France-headquartered contract logistics business owned by the CMA CGM Group, confirmed a cyberattack against eight of its European warehouses between 29 July and 1 August 2026. The company has not said how attackers got in. It has confirmed that names, addresses, phone numbers, emails and order data belonging to customers of Bol, De Bijenkorf, ING, Ajax, Ace & Tate and Valve's Steam hardware business were taken. The Dutch data protection authority has already received breach notifications from ten separate organisations tied to the same incident.
Read articleLuna Moth never touched WilmerHale's network. It still walked away with eighteen million dollars.
Silent Ransom Group, tracked as Luna Moth, obtained sensitive client and employee data from Wilmer Cutler Pickering Hale and Dorr LLP (WilmerHale) after an employee handed over information to a caller who had misrepresented their identity. WilmerHale has stated the group never accessed its systems or network. The firm reportedly paid at least eighteen million dollars to keep the stolen data from being published. No password was cracked and no server was breached.
Read articleLevi Strauss can name the three employees who were deceived. It cannot name who deceived them.
Levi Strauss & Co. disclosed on 7 August 2026 that hackers used social engineering to compromise three employees' company-issued computers and exfiltrate corporate data. No group has claimed the attack, and Levi's has not said what was taken. The company says the intrusion was contained quickly and that consumer data was not affected. Three unremarkable interactions did what years of firewall investment could not.
Read articleShinyHunters claims 25 million Alcon records. Alcon has said nothing for a week.
The extortion group ShinyHunters added Alcon Inc., the Geneva-headquartered eye care company, to its dark web leak site on 1 August 2026, claiming to have exfiltrated more than 25 million Salesforce records containing personal data. The group gave Alcon until 4 August to open negotiations or face a public leak. That deadline passed five days ago. Alcon has not confirmed a breach, named an entry point, or said what was taken.
Read articleTwo hundred Swiss government accounts were compromised. Some of them belonged to no one.
Switzerland's Federal Office for Information Technology and Telecommunication (BIT) has confirmed that attackers exploited unpatched Microsoft SharePoint vulnerabilities to compromise roughly 200 accounts, including technical accounts with no individual user attached to them. The intrusion sat undetected for three days before anomalous activity triggered a review. BIT found no evidence data was taken, only that the credentials themselves were. No group has claimed the attack, and nobody has said which of two known flaws let them in.
Read articleThe specially created account that opened Liechtenstein's beneficial owners register
Liechtenstein's government confirmed this week that attackers spent the night of 29 to 30 July 2026 inside the Register of Beneficial Owners, the national database identifying who really owns the companies, foundations and trusts registered in the principality. They used what officials describe only as a specially created user account to copy records tied to roughly 31,000 legal entities. Nobody has said who created that account. Nobody has said why nothing challenged it.
Read articleFour Wall Street hedge funds faced the same cloned voice. Only one will say it stopped.
On 5 August 2026, AI-generated voice clones of trusted executives and colleagues called employees at Citadel, Point72 Asset Management, Two Sigma Investments and Millennium Management, attempting to talk their way into credentials and system access. Two Sigma says it caught the attempt before anything was compromised. Point72 admits it was attacked and says no client data has left the building so far. Citadel and Millennium have said nothing at all.
Read articleThe unpatched SonicWall appliance. The stolen credentials. The 885 victims who found out from a leak site.
Security researchers at Resecurity and Rapid7 have traced a wave of ransomware intrusions to two zero-day flaws in SonicWall's Secure Mobile Access (SMA) 1000 series VPN appliances, exploited since 22 June 2026. INC Ransomware, now the dominant actor working the flaw, has claimed 885 victims across the United States, Australia, the United Arab Emirates, Colombia and Switzerland. The group did not need a phished password. It extracted credentials, session data and multi-factor authentication seeds directly from the compromised appliance, then walked into networks that had no further checkpoint waiting for it.
Read articleBlog content generation is AI assisted.