Blog
The Execution
The cybersecurity industry has spent decades and trillions of dollars building tools that operate after the fact.
Detect the breach. Respond to the incident. Recover the systems. Investigate the fraud.
Every one of those disciplines assumes the damage has already occurred and the goal is to limit it. Below, we examine what that assumption costs: real breaches, real losses, real organisations that did everything the industry told them to do and still lost. The question running through every post is the same: at the moment the consequential action executed, where was the human who should have stopped it?
Nikkei disclosed three account compromises in two weeks. The 1.83 million record exposure was the third.
Nikkei Inc. has disclosed that attackers reportedly used compromised credentials to reach a cloud service it uses for system development, exposing about 1.83 million records. Roughly 150,000 of those contained personal information. It followed two separate account-based incidents the company had disclosed twelve days earlier. A login was the way in every time. Nothing had to be broken.
Read articleSixteen South Korean financial firms were reportedly entered by suspected AI agents through internal support systems
Sixteen South Korean financial firms were reportedly entered by suspected AI agents through internal support systems. Nobody had to approve the access. South Korea's Financial Services Commission (FSC) has disclosed that suspected AI agent-driven attacks have reached 16 financial firms since early October, exposing about 100,000 personal records. The targets include Shinhan Bank, KB Kookmin Bank and Hana Bank. The attackers reportedly did not touch core banking networks. They went through internal support systems that nobody was asking to justify access.
Read articleAmpath says 80 million records is overstated. It has not said how ByteToBreach got in.
South African pathology group Ampath Laboratories says it was hit by a cyberattack on 2 October 2026. A threat actor calling itself ByteToBreach reportedly claims it copied 10 of Ampath's roughly 375 databases and that one admissions table alone holds more than 80 million records. Ampath calls that figure overstated. It has not said how the attacker got in.
Read articleASOS reportedly lost a staff login to a trusted-contact impersonation, and its own app announced the breach
ASOS, the British online fashion retailer, has confirmed that an unauthorised party obtained an employee's login by impersonating a trusted contact. The stolen credentials were then used to reach third-party platforms, including the one that sends push notifications to the ASOS app. A group calling itself Xuanye Group reportedly used that access to tell customers the company had been hacked. Nobody had to break the app. They only had to be believed.
Read articleDenmark gave a private company access to the national register. Someone else used it to look up 8.8 million people.
Denmark's digitalisation ministry has confirmed that attackers used a private company's legitimate access to the Central Person Register to pull the names, addresses and personal identity numbers of about 8.8 million people. That is roughly 80 percent of the register. The activity ran for around ten days before anyone noticed. The minister admitted the safeguards around this kind of access had not been solid enough.
Read articleA WhatsApp message from the CEO, a cloned lawyer's voice, and €95 million gone from Fideuram in two days
Fideuram, the private banking arm of Intesa Sanpaolo, was reportedly defrauded of €95 million after its then-chairman was walked through an "urgent acquisition" by attackers impersonating the group CEO and a senior law firm partner. A second caller posed as Fideuram's own chief executive to prime the payments officer. Eleven transfers left the bank before anyone stopped the process. Roughly €36 million is reported to remain unrecovered.
Read articleBitget's authorisation system worked exactly as designed. It approved a request no one at Bitget made.
On 24 September 2026, suspected North Korean hackers moved $351.6 million out of Bitget's hot and warm wallets in a matter of minutes. They did not steal a private key. They compromised a backend system, spoofed transaction data, and triggered the exchange's own authorisation process into approving the transfer. The system did exactly what it was built to do, for the wrong person.
Read articlePREY-0058 rang executives pretending to be IT, then reportedly emptied SharePoint, OneDrive, Exchange and Box
Arctic Wolf researchers have documented a vishing campaign, tracked as PREY-0058, that targets directors, vice presidents and executives across US organisations. Callers pose as internal IT help desk staff, walk the target through a fake passkey registration, and capture credentials, multi-factor authentication codes and session tokens. The attackers then reportedly pull data in bulk from Microsoft 365 and Box and follow up with extortion demands. There was no malware and no lateral movement, only a phone call and a valid session.
Read articleTwo tankers, boarded by the Coast Guard, on the say-so of a hardware kill switch. That's the fix everyone should be watching.
In late August, the U.S. Coast Guard and FBI boarded two tankers in the Gulf of Mexico after their onboard systems reportedly stopped responding to remote commands. Weeks earlier, a Mediterranean LNG carrier's crew said their own systems had been hijacked and used to divert the ship, a claim Italian authorities have described more cautiously as a malfunction. Behind both stories sits a hardware approach already deployed on other vessels: a physical air gap that disconnects a ship's operational systems from the network by default. It is a serious control. It is also only half the problem.
Read articleGreenberg Traurig protects attorney-client privilege for a living. It could not protect 126,000 people's Social Security numbers.
Silent Ransom Group, the extortion outfit also tracked as Luna Moth, compromised a single employee's corporate iPad at Greenberg Traurig in August 2026. Five people inside the firm were infected before anyone noticed. When a ransom deadline passed, the group published Social Security numbers, medical records, tax returns and passports belonging to roughly 126,000 people. Greenberg Traurig called it a limited incident and has said nothing about notifying most of them.
Read articleBlog content generation is AI assisted.