Blog
The Execution
The cybersecurity industry has spent decades and trillions of dollars building tools that operate after the fact.
Detect the breach. Respond to the incident. Recover the systems. Investigate the fraud.
Every one of those disciplines assumes the damage has already occurred and the goal is to limit it. Below, we examine what that assumption costs: real breaches, real losses, real organisations that did everything the industry told them to do and still lost. The question running through every post is the same: at the moment the consequential action executed, where was the human who should have stopped it?
Why did Ernst & Young take 26 days to notice its support desk was leaking client tax returns?
An unauthorised party spent sixteen days inside a third-party support ticket platform used by Ernst & Young's tax practice, downloading client documents before anyone noticed. EY did not detect the intrusion until 23 April 2026, eleven days after the access had already ended. The exposed data includes personal information and, for some clients, Social Security numbers and financial account details tied to their tax filings. EY has not said how many people are affected or how the platform was breached in the first place.
Read articleHugging Face's forensic AI was blocked by safety guardrails. The AI that attacked it had none.
Hugging Face has disclosed that a fully autonomous AI agent breached part of its production infrastructure earlier this month, needing no human operator to escalate privileges, harvest credentials, and move laterally across internal clusters. The company detected the intrusion largely with AI of its own, reconstructing more than 17,000 attacker actions in hours. No person directed a single step of the attack. No person had to be fooled, bribed, or impersonated for it to succeed.
Read articlePassword resets are execution events. Two teenagers turned one into a £29 million shutdown of London's transport network.
Two members of the hacking collective Scattered Spider have been sentenced to five and a half years each for a 2024 attack that took Transport for London (TfL) offline. The intrusion began with a single phone call to TfL's IT helpdesk, an attacker impersonating an employee, asking for a password reset. TfL's own decision to pull its network down was the only thing standing between that call and a hypothetical £56 billion blackout of the transport system. The confirmed bill for what happened before the shutdown: £29 million.
Read articleThe passkey enrolment tool Microsoft built to stop phishing became the phishing lure itself.
In May 2026, Microsoft gave administrators a new way to fight phishing: passkey registration campaigns that let employees enrol hardware-bound credentials in place of passwords. Within weeks, a vishing gang tracked as Pink was calling employees at food, healthcare, and aviation companies, telling them the same passkey enrolment was mandatory, then walking them through registering the attacker's device instead of their own. Okta researchers found the phishing kit adapts to each victim's multi-factor method in real time, with a one second heartbeat between the fake page and the operator on the other end of the call. The tool built to end phishing became the newest way to conduct it.
Read articleDigitalMint's ransomware negotiator had a private channel his employer couldn't see. He used it to tell BlackCat what to demand.
A ransomware negotiator hired to protect his clients spent seven months in 2023 relaying their confidential negotiation limits straight to the BlackCat ransomware gang extorting them. Angelo Martino, then working for Chicago-based incident response firm DigitalMint, told the attackers what his clients could really afford to pay, and pocketed a cut of the proceeds. He was sentenced on 3 July 2026. Five of his clients paid a combined $75 million in ransoms he helped inflate.
Read articleThe exposed staging server that connected 110 million stolen firewall credentials to two ransomware gangs
Researchers at SOCRadar have linked a mass credential harvesting campaign called FortiBleed directly to ransomware deployment for the first time. Attackers scanned 430,000 Fortinet FortiGate firewalls, harvested more than 110 million credentials, and handed verified access to the INC Ransom and Lynx ransomware operations. At least twelve ransomware deployments followed, encrypting hundreds of endpoints across affected organisations. The link was only discovered because the attackers made a mistake.
Read articleOracle patched the PeopleSoft flaw on 10 June. ShinyHunters had already been inside Moody Bible Institute for two weeks.
ShinyHunters spent two weeks inside Oracle PeopleSoft servers using a vulnerability Oracle had not yet patched. By the time Oracle published its advisory on 10 June 2026, the group had already reached Moody Bible Institute, a Chicago-based Christian college, and was preparing to list it on a leak site. More than 2.3 million donors, students, alumni and staff had their data taken. Nobody confirmed a single export while it happened.
Read articleA phishing email aimed at one AssuranceAmerica employee ended up costing nearly seven million Americans their driver's licence numbers
On 16 March 2026, a phishing attack singled out a single employee at AssuranceAmerica, the Atlanta-based auto and renters insurer distributed through more than 9,500 independent agents across fourteen US states. The stolen credentials opened a path into the company's IT systems, and an unauthorised party copied files covering nearly 6.9 million people, including driver's licence numbers, Social Security numbers, and insurance claims data. No ransom note has surfaced. No group has claimed it. Notification letters only began reaching customers on 10 July, nearly four months after the intrusion began.
Read articleAttackers cloned senior executives' voices, forged their signatures, and walked away with three million euros from Capillary Technologies
Capillary Technologies, the Bengaluru-headquartered SaaS provider behind customer loyalty platforms for retailers and consumer brands worldwide, has disclosed that one of its recently acquired subsidiaries lost approximately three million euros to a cyber-enabled banking fraud. Attackers used deepfake voice cloning and forged signatures to impersonate senior executives and authorise transfers to third-party accounts. The company has recovered around €450,000 so far. The rest is still missing.
Read articleAccenture called it an isolated matter. A hacker was already selling the keys.
A threat actor operating under the handle 888 claims to have pulled 35 gigabytes of source code, RSA keys, SSH keys, and Azure access tokens out of Accenture through a single compromised, internet-facing credential node. Accenture confirmed a breach on 7 July 2026, calling it an isolated matter that had already been remediated. It has not confirmed what was taken, how much, or whether remediation came before or after the data left. The stolen material was already listed for sale on a cybercrime forum before Accenture said a word.
Read articleBlog content generation is AI assisted.