T-Mobile API Scraping 2023: 37M Accounts, One Credential
A single compromised API credential let an actor scrape ~37 million T-Mobile accounts over six weeks. Machine-identity governance lessons from a repeat offender.
Royal Mail vs LockBit: The $80M Ransom Refusal
LockBit encrypted Royal Mail's international sorting operations in January 2023 and demanded $80M. Royal Mail paid nothing and kept the letters moving.
KeePass Plaintext Export ‘Flaw’: The Trust-Boundary Debate
CVE-2023-24055 showed a config-planted trigger could export KeePass vaults in plaintext after unlock. The debate: feature, flaw, or threat model?
LastPass Vault Theft Confirmed: The December Reckoning
LastPass confirmed attackers copied encrypted vault backups after pivoting through a DevOps engineer's endpoint. KDF legacy and unencrypted metadata set the real risk.
Guardian Ransomware: The Newsroom That Kept Printing
Ransomware forced the Guardian's newsroom off its networks for weeks in late 2022 — yet print and web kept publishing. Editorial continuity lessons.
InfraGard Portal Breach: Account Takeover Inside the Vetted
USDoD hijacked a chapter president's InfraGard account and listed 87,000 members' PII for sale. Identity lessons for trusted-community portals.
Rackspace Hosted Exchange Ransomware: The Outage That Killed a Legacy
Rackspace's December 2022 ransomware incident took Hosted Exchange down for weeks, ended the product's life, and cost $12M+. Legacy platform lessons.
FortiOS SSL-VPN Heap Overflow: Pre-Auth Emergency
CVE-2022-42475 was a CVSS 9.8 pre-auth heap overflow in FortiOS SSL-VPN, patched silently then confirmed exploited. Edge memory safety lessons.
ChatGPT’s Launch and the Dawn of Prompt Injection
ChatGPT landed November 30, 2022 and hit 100M users in two months — and immediately made prompt injection a practical attack class. Still unsolved in 2026.
FTX Collapse: The Wallet Drains Custody Controls Never Defined
As FTX fell, hundreds of millions moved from its wallets — later attributed mostly to insiders per trial testimony. Custody without governance is the vulnerability.
ProxyNotShell: Exchange Zero-Days Auctioned Before the Patch
Two Exchange zero-days chained SSRF-to-RCE were sold on a forum before Microsoft's November 2022 patch — and mass-exploited in the gap. Assume-the-edge lessons.
BNB Chain 2022: The $570M Forgery Contained by a Chain Pause
An attacker forged a bridge proof to mint 2M BNB (~$570M), then validators halted the chain mid-launder. Only ~$100M escaped before the freeze.
- Go to the previous page
- 1
- …
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- …
- 28
- Go to the next page