Cloud & Infrastructure

National Public Data: 2.9B SSN Records for the Price of a Breach

Post author:Prabhu Kalyan Samal
Post published:September 3, 2026
Post category:Cloud & Infrastructure Identity & Phishing Security

In August 2024, national background-check broker National Public Data confirmed a breach that leaked roughly 2.9 billion rows of personal records — names, addresses, relatives, SSNs — covering plausibly every US adult and parts of the UK and Canada, after a criminal actor first offered the data for sale in April and a third party then dumped 277GB free. This account traces the broker supply chain that assembled the dossier, the class-action lawsuit that forced acknowledgment, and the post-SSN security posture every organization now needs.

CrowdStrike Falcon Outage: 8.5M Hosts & Fragile Architecture

Post author:Prabhu Kalyan Samal
Post published:September 3, 2026
Post category:Cloud & Infrastructure Emerging Tech & Architecture Security

On July 19, 2024, a routine sensor configuration update from CrowdStrike passed staged testing and rolled through the Falcon channel to roughly 8.5 million Windows hosts — and crashed them into Blue Screens of Death, grounding flights, halting broadcasters and hospitals in the largest IT outage in history. This account reconstructs the flawed content-deployment pipeline, the Channel File 291 logic that sent the kernel into chaos, the 78-minute Remediation and guidance HHCfollows, the blame theater that followed, and why the incident rewrote every argument about single-vendor concentration risk.

AT&T’s Snowflake Ransom Payment: The $370K Precedent

Post author:Prabhu Kalyan Samal
Post published:September 3, 2026
Post category:Cloud & Infrastructure Ransomware & Malware Security

On July 31, 2024, AT&T confirmed its customer data — including call and text metadata of nearly all subscribers and some SSNs — had been stolen off Snowflake’s cloud via compromised service-account credentials, and that it had paid roughly $370,000 to the SQlMap-scanning crew known as ShinyHunters to delete it. This account reconstructs the credential theft, the infostealer-to-Snowflake kill chain, the economics of a mid-six-figure ransom, and the quarterly-burial of accountability between carrier, and its data-warehouse vendor.

APT29 Inside TeamViewer: 2024’s Calmest, Most Instructive Breach

Post author:Prabhu Kalyan Samal
Post published:September 3, 2026
Post category:Cloud & Infrastructure Identity & Phishing Security

On June 28, 2024, TeamViewer disclosed that a state-sponsored actor — widely reported as Russia’s APT29 — had breached its corporate IT network through a standard employee’s credentials, and that the remote-access product itself, and every customer, stayed untouched. This account reconstructs the hours-to-containment timeline, explains why corporate/product segmentation carried the day, places the intrusion in Cozy Bear’s patient espionage season, and draws the anti-SolarWinds comparison that made this 2024’s most instructive breach.

Brain Cipher vs Indonesia’s Data Centers: A National Ransomware Reckoning

Post author:Prabhu Kalyan Samal
Post published:September 3, 2026
Post category:Cloud & Infrastructure Ransomware & Malware Security

In June 2024, the Brain Cipher crew — running a LockBit 3.0 builder clone — encrypted Indonesia’s National Data Center, disrupting 200+ government services from immigration to licensing, then released a decryptor with an apology-flavored admission that extortion failed, then hit again during recovery. This account covers the copycat-crew economics behind the operation, why one shared-tenant data center meant national outage, the second-encryption lesson about persistence, and the segmented-architecture rebuild Indonesia promised next.

Snowflake Extortion: 165+ Customers, One Credential Wave

Post author:Prabhu Kalyan Samal
Post published:September 3, 2026
Post category:Cloud & Infrastructure Identity & Phishing Security

On June 19, 2024, Mandiant’s public advisory named UNC5537 as the crew behind the Snowflake extortion wave — 165+ victim organizations entered with infostealer credentials against MFA-less tenants, datasets extorted through listings and a dedicated leak market researchers dubbed Snow:Bay. This piece condenses the TTP catalogue, the backyard economics of stolen logs, the aftermarket that changed notification obligations forever, and the single control that would have prevented every confirmed intrusion.

Snowflake-Ticketmaster: The Cloud-Secure Myth Breaks

Post author:Prabhu Kalyan Samal
Post published:September 3, 2026
Post category:Cloud & Infrastructure Identity & Phishing Security

Live Nation’s May 2024 SEC filing confirmed criminal access to roughly 560 million Ticketmaster customer records — taken not by exploiting Snowflake but by logging into it with infostealer-derived credentials on a tenant without MFA. This account explains the UNC5537 tradecraft that chained $20 stealer logs into Fortune-500 data lakes, why the ‘no Snowflake breach’ defense only half-worked, what the ~560M-record dataset contained, and the mandatory-MFA wave that reshaped SaaS identity through 2024.

CrushFTP VFS Sandbox Escape: Zero-Trust Patch Confusion in File Transfer

Post author:Prabhu Kalyan Samal
Post published:September 3, 2026
Post category:Cloud & Infrastructure Security Supply Chain Security

On April 19-20, 2024, CrushFTP shipped emergency fixes for CVE-2024-4040 — an unauthenticated escape from the virtual file system sandbox that exposed arbitrary host files, including the credential-stuffed configuration that anchors enterprise partner integrations. Exploitation followed within days, CISA listed it April 30, and a chaotic trail of interim builds left customers arguing about version numbers mid-fire. This account covers the traversal-to-escape chain, the mainserv credential hunt, and the hard lessons of small-vendor emergency patching.

PAN-OS GlobalProtect Zero-Day: CVE-2024-3400 Explained

Post author:Prabhu Kalyan Samal
Post published:September 3, 2026
Post category:Cloud & Infrastructure Security Web & API Security

On April 12, 2024, WatchTowr disclosed CVE-2024-3400 — a CVSS 10.0 pre-auth command injection in PAN-OS GlobalProtect that state-sponsored actors had exploited since late March by chaining a cookie-controlled file write into Tcl execution as root. This account walks the two-flaw exploit chain, the scramble after the 10.2.9-h1 hotfix, CISA’s KEV clock, config-hidden persistence that survived reboots, the mitigation-versus-remediation confusion, and why 2024 made appliances patch with server-grade urgency.

ConnectWise ScreenConnect Auth Bypass: An Instant RCE Wave

Post author:Prabhu Kalyan Samal
Post published:September 3, 2026
Post category:Cloud & Infrastructure Security Web & API Security

February 2024’s CVE-2024-1709 let anyone add administrative accounts to self-hosted ScreenConnect servers — a setup-wizard path traversal that converted remote-support consoles into ransomware deployment platforms within 72 hours of disclosure. This account covers the twinned vulnerabilities, why MSP-hosted instances multiplied the blast radius across client fleets, the observed ransomware sequences, and the hard questions RMM vendors faced about unauthenticated wizard endpoints.

Wyze Camera Flaw: 13,000 Strangers Through One Caching Hole

Post author:Prabhu Kalyan Samal
Post published:September 3, 2026
Post category:Cloud & Infrastructure Identity & Phishing Security

Two February 2024 vulnerabilities let Wyze app users briefly see thumbnails and live feeds of strangers’ cameras — a cache-key failure amplified by a three-year-old flaw resurfacing in redesigned hardware. This account covers the date-based cache-key bug, the 13,000 affected users, the nine-hour fleet update, and the uncomfortable questions about budget-camera security engineering when the same vendor has now repeated the vulnerability class.

Ivanti Connect Secure Zero-Days: The Edge-Appliance Crisis

Post author:Prabhu Kalyan Samal
Post published:September 3, 2026
Post category:Cloud & Infrastructure Security Web & API Security

January 2024 opened with the year’s first appliance crisis: two pre-authentication zero-days in Ivanti Connect Secure that nation-state actors had already exploited, followed by integrity-check failures and a reset wave across thousands of enterprise VPNs. This account covers CVE-2023-46805 and CVE-2024-21887, the mass exploitation between disclosure and patch, the customers whose breaches surfaced weeks later, and why edge appliances became the year’s most contested patch surface.