Prabhu Kalyan Samal

Change Healthcare ALPHV: The Ransomware That Broke US Healthcare

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Emerging Tech & Architecture Ransomware & Malware Security

One ALPHV/BlackCat intrusion in February 2024 froze claims and pharmacy payments across US healthcare for weeks — the single most consequential ransomware attack of the year. This account covers the nine-day dwell time, the $22 million ransom payment and the exit-scam double-cross that brought RansomHub back for seconds, the eventual disclosure of hundreds of millions of records, and why one processor’s central position converted a single encryptor into a national healthcare liquidity crisis.

MGM, Caesars, and Scattered Spider: The Vishing Fall of 2023

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Cloud & Infrastructure Identity & Phishing Security

In September 2023 Scattered Spider vished the MGM helpdesk, pivoted through Okta to ESXi, and detonated ALPHV ransomware — a $100M quarter for MGM while Caesars paid up. The reference incident for helpdesk verification, MFA fatigue, and pay-vs-rebuild economics.

Cisco BroadWorks CVE-2023-20237: The SSO Bypass Scare

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Cloud & Infrastructure Security Web & API Security

In September 2023 Cisco rushed out patches for CVE-2023-20237, a critical authentication bypass in BroadWorks’ single-sign-on flows that could let attackers authenticate as any user. With evidence of active scanning, carrier admins ran an emergency patch marathon.

Downfall and Inception: Speculation Tax Comes Due

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Cloud & Infrastructure Cryptography & PKI Security

August 2023’s dual CPU side-channel reveals — Downfall on Intel and Inception on AMD — proved transient execution is a permanent tax on modern computing, payable in microcode updates and measured performance regressions.

Discord.io Breach: When Brand Adjacency Becomes Attack Surface

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Identity & Phishing Security

Roughly 100,000 Discord.io user accounts were dumped for sale in August 2023 — and the confusion with Discord itself proved that brand-adjacent third parties are breach surface for your users even when your systems are never touched.

Citrix NetScaler CVE-2023-3519: Breached Before the Advisory

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Cloud & Infrastructure Security Web & API Security

The July 2023 NetScaler ADC/Gateway pre-auth RCE hit government networks as a true zero-day — and post-patch webshell persistence taught defenders that appliance remediation means rebuild, not upgrade.

SEC’s Four-Day Breach Rule: Disclosure Becomes a Control

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Emerging Tech & Architecture Security

The SEC’s July 2023 cybersecurity rule put public companies on a four-business-day material-incident filing clock — turning breach disclosure into a rehearsed, enforceable, executive-owned security capability.

Reddit’s API Blackout: Pricing the Data Border

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Emerging Tech & Architecture Security

Reddit’s 2023 API repricing killed Apollo and third-party clients, sent 7,000+ subreddits dark in protest, and drew the template for the AI-era data licensing wall.

Storm-0558 Forged-Token Breach: The Stolen Key That Read Government Email

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Cloud & Infrastructure Identity & Phishing Security

China-linked Storm-0558 forged Azure AD tokens with a stolen Microsoft consumer signing key and read email at ~25 organizations including the State and Commerce departments — exposing vendor key hygiene, token scope validation, and log-tiering as board-level security questions.

MOVEit Transfer Zero-Day: Cl0p’s Memorial Day Heist

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Security Supply Chain Security Web & API Security

CVE-2023-34362 in MOVEit Transfer let Cl0p deploy the LEMURLOOT web shell at scale over Memorial Day weekend — pure data extortion, no encryption, hundreds of downstream victims.

MOVEit’s Ledger: 2,700 Orgs, 93 Million People

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Security Supply Chain Security Web & API Security

Cl0p’s June 2023 listing waves turned the MOVEit breach into a running census — 2,700+ organizations and ~93M individuals per Emsisoft tallies. The economics of encryption-free extortion.