Blog
The Execution
The cybersecurity industry has spent decades and trillions of dollars building tools that operate after the fact.
Detect the breach. Respond to the incident. Recover the systems. Investigate the fraud.
Every one of those disciplines assumes the damage has already occurred and the goal is to limit it. Below, we examine what that assumption costs: real breaches, real losses, real organisations that did everything the industry told them to do and still lost. The question running through every post is the same: at the moment the consequential action executed, where was the human who should have stopped it?
A fired employee's database access should have ended the moment the meeting did. At Opexus, it did not.
Opexus fired twin brothers Sohaib and Muneeb Akhter on a video call after discovering one of them was a convicted felon, but their access to the company's federal government systems was still live when the call ended. Within hours, the brothers had deleted 96 databases holding U.S. government data, including software federal agencies used to process Freedom of Information Act requests. A federal jury convicted Sohaib in May. He faces up to 21 years.
Read articleWhy can't the UK's Police National Legal Database explain how 100,000 officer records left the building?
The Police National Legal Database (PNLD), the legal reference service used by all 43 Home Office police forces in England and Wales, detected an intrusion on 26 July 2026. The extortion group ExfilSquad claims it exported 1.9 gigabytes of data, including records tied to more than 100,000 serving police officers, prosecutors and national security staff. PNLD found no evidence that a single password or login was compromised. The records left anyway.
Read articleBrinks Home protects a million homes. It couldn't protect one login from a phone call.
ShinyHunters says it vished its way into a Brinks Home employee's Microsoft Entra account on 13 July 2026, using nothing more than a phone call. The group claims it walked out with 4.9 million records, including 1.1 million customer accounts, thousands of employee files, and millions of support chat logs. Brinks Home did not notice for a week. The systems that arm a million homes against intruders had no equivalent control for the one that mattered most.
Read articleThe Microsoft Entra prompt that handed ShinyHunters access to Brinks Home's Salesforce records
ShinyHunters reportedly called a Brinks Home employee, posed as Microsoft IT support, and talked them through approving a Microsoft Entra authentication request. The call, not a stolen password or an exploited vulnerability, is what opened the door. From there the group claims to have pulled more than 1.1 million customer records, over 4,000 employee files and 3.8 million support chat logs out of Salesforce. Brinks Home has confirmed the intrusion; it has not confirmed the numbers.
Read articleWhy can't Analog Devices confirm whether the extortion claim and its June breach are the same attack?
Analog Devices confirmed in a securities filing that intruders accessed its internal systems on 23 June 2026 and exfiltrated files, though the company still does not know what was taken. Five weeks later, a data extortion group calling itself ExfilSquad listed Analog Devices on its leak site, claiming to hold 570,000 customer records including home addresses. Analog Devices says it cannot yet confirm whether the two incidents are connected. Two breaches, or one, and nobody outside the intrusion knows which.
Read articleCraneware's incident response was textbook. The data still left the building.
On 20 July 2026, Craneware plc, the Edinburgh-based software provider that bills a substantial share of America's hospitals, disclosed unauthorised access to its systems and confirmed that employee and customer data had been taken. Eight days later, the Chaos ransomware group added Craneware to its dark web leak site, claiming to have exfiltrated internal files in a ransomware attack. Craneware has not said how the attackers got in. Two disclosures, two different stories, and the data is already gone.
Read articleWhy did one employee's inbox hold the keys to a terabyte of Bank of Baroda customer data?
Bank of Baroda, India's second-largest state-owned bank, confirmed this week that a single employee's compromised email account exposed customer and internal data spanning savings accounts, loan files, KYC records and Aadhaar numbers. The ransomware group Triple X says it took a terabyte of records and published the whole set for free, "to teach a lesson," rather than waiting for a ransom. No zero-day. No breach of core banking systems. One inbox, protected by nothing more than a password.
Read articleThe unconfirmed export that turned 2.6 million dental records into 23 million
ShinyHunters claims it exfiltrated 234 gigabytes of data from DentaQuest, the largest Medicaid and Children's Health Insurance Program dental benefits administrator in the United States, during a three day intrusion in May 2026. The group's opening claim was 2.6 million people. Two months of forensic review later, DentaQuest has confirmed at least 15 million individuals affected, with an independent analysis of the leaked data suggesting the true figure could exceed 23 million, some of them children. Nobody has said how many records left the network during those three days, only how many have since turned up.
Read articleChick-fil-A's loyalty accounts were breached by the same attack twice
Chick-fil-A confirmed this month that automated attackers logged into an undisclosed number of Chick-fil-A One loyalty accounts using passwords stolen from unrelated breaches. The credential stuffing attack ran for three days in June before anyone noticed. It is the second time in three years that stolen passwords alone have been enough to take over the company's loyalty accounts. Nobody asked the accountholder to confirm anything before their stored credit and payment details became visible to a stranger.
Read articleAn AI agent mapped Thailand's Ministry of Finance from the inside. Nobody had to approve a single command.
Between 9 and 13 July 2026, researchers at Hunt.io and Bob Diachenko found three exposed web directories tied to an intrusion into Thailand's Ministry of Finance. Inside were exploit tools, stolen credentials, and operator logs from Hermes, an open-source AI agent running in "YOLO mode", a setting that strips out the prompts asking a human to approve dangerous commands. Left unattended, the agent escalated privileges, mapped internal systems, and catalogued personnel files without a single step needing sign-off. The Ministry has not confirmed a breach.
Read articleBlog content generation is AI assisted.