Medibank 2022: The Ransom Refusal That Published Patients
Criminals entered Medibank via a contractor’s VPN credentials on a gateway without MFA, then dumped 9.7M customers’ health data after the ransom refusal.
Engineering deep dives for builders: MCP and AI-tooling internals, API design and abuse cases, cloud and infrastructure (Terraform, Kubernetes, CI/CD), and the platform-security angles that come with them. Written by the researcher behind Hmmnm – practical, current, and tied to the security practice.
The Telegram Arrest and the Encryption Debate of 2024
On August 24, 2024, French authorities arrested Telegram founder Pavel Durov at Le Bourget airport, and two days later charged him with complicity in organized-crime offenses enabled by his platform’s refusal to cooperate with legal process — the first time a major encrypted-service executive faced criminal liability for governance choices. Released under judicial supervision within days, Durov’s case forced every platform lawyer to reprice jurisdictional arbitrage, moderation staffing, and the meaning of cooperation. This account lays out the charges, the encryption-policy fault lines, and the compliance playbook that followed.
CrowdStrike Falcon Outage: 8.5M Hosts & Fragile Architecture
On July 19, 2024, a routine sensor configuration update from CrowdStrike passed staged testing and rolled through the Falcon channel to roughly 8.5 million Windows hosts — and crashed them into Blue Screens of Death, grounding flights, halting broadcasters and hospitals in the largest IT outage in history. This account reconstructs the flawed content-deployment pipeline, the Channel File 291 logic that sent the kernel into chaos, the 78-minute Remediation and guidance HHCfollows, the blame theater that followed, and why the incident rewrote every argument about single-vendor concentration risk.
LockBit Takedown: Operation Cronos and Its Awkward Aftermath
February 2024’s Operation Cronos seized LockBit’s infrastructure across a dozen countries — and then the leaks showed how long the FBI had been inside. This account covers the covert access, the sting timing driven by UK hospital targeting, the servers and affiliate accounts taken down, the hurried rebrand to LockBit 4.1, the affiliate diaspora to RansomHub and Akira, and the awkward questions the takedown’s trolling raised about reading crime statistics.
DP World Australia: When a Cyber Incident Stopped the Cranes
On 13 November 2023, DP World Australia disconnected its port systems from the internet to contain an intrusion — and container operations at Sydney, Melbourne, Brisbane and Fremantle stopped cold, stranding roughly 30,000 containers for three days. Operations resumed by 16 November, personnel data exposure was later confirmed, and no ransom payment was disclosed. The episode became Australia’s reference case for cyber-driven supply-chain disruption and a model of disciplined containment, rapid restoration and honest capacity communication under SOI-Act scrutiny.
Costa Rica’s Conti Emergency: When Ransomware Became a National Crisis
Conti encrypted the treasury during tax season, declared war on the government, and forced the world’s first ransomware state of emergency.
Conti’s 60,000 Chats: Anatomy of a Ransomware Giant
A pro-Russia statement, a furious insider, and the full Jabber archive of history’s most damaging ransomware brand — dumped for everyone to read.
M-22-09: The Memo That Made Zero Trust Federal Law
OMB’s January 2022 mandate gave zero trust deadlines, named technologies, and an oversight structure — rewriting industry roadmaps worldwide.
REvil Takedown: How 14 Arrests Killed Ransomware’s Worst Brand
October 2021’s FSB operation ended REvil with arrests, asset seizures, and infrastructure capture. The talent lived on elsewhere.
Pegasus Zero-Click: Spyware That Needed No Click at All
The Pegasus Project exposed 50,000 targeted numbers and a hard truth: modern mercenary spyware infects phones through iMessage and WhatsApp without the victim doing anything.
JBS Foods Ransomware: Paying $11M Even With Working Backups
REvil halted the world’s largest meat processor over a holiday weekend; JBS restored from backups — and still paid $11M for leak suppression and restart insurance. The economics of ransom beyond decryption.
Biden’s Zero Trust Executive Order: The Procurement Pivot
EO 14028 turned zero trust from slide-ware into federal procurement doctrine — MFA, SBOMs, NIST 800-207, the Cyber Safety Review Board — and reset vendor incentives industry-wide.