credential theft

Sisense Breach: CI Credentials, AWS Keys and a CISA Advisory

Post author:Prabhu Kalyan Samal
Post published:April 26, 2024
Post category:Cloud & Infrastructure Security Supply Chain Security

On April 24, 2024, CISA and the FBI advised every Sisense customer to rotate credentials after attackers compromised the BI vendor's development environment — and by week's end, Sisense-issued AWS keys were circulating publicly. This piece reconstructs the five-day arc from detection to contained, explains why business-intelligence platforms are credential funnels that turn vendor CI/CD breaches into customer incidents, and extracts the third-party-risk doctrine the episode left behind for every embedded-analytics supply chain.

AnyDesk Breach: Production Compromise and a Certificate Sprint

Post author:Prabhu Kalyan Samal
Post published:February 4, 2024
Post category:Identity & Phishing Security Supply Chain Security

Remote-access maker AnyDesk confirmed in February 2024 that attackers had compromised production systems using valid credentials traced to infostealer logs — forcing a certificate rotation, password resets, and a rushed 8.1.1 release whose code-signing was intact but whose credibility needed rebuilding. This piece covers the infostealer-to-supply-chain escalation path that rewired vendor-risk thinking, and why remote-admin tooling became a tier-one identity perimeter.

Mr. Cooper Mortgage Breach: The Week Payments Stopped

Post author:Prabhu Kalyan Samal
Post published:December 18, 2023
Post category:Identity & Phishing Ransomware & Malware Security

When one of America's largest mortgage servicers went dark for a week, the harm went far beyond stolen data. The Mr. Cooper incident — detected October 24, disclosed October 31, 2023 — halted payments, escrow, and payoffs for millions of borrowers, and later filings put the notification count near 14.7 million people with Social Security numbers and bank account details in the mix. This account covers the stolen-credential entry, the outage that regulators treated as the real injury, the mortgage-sector dependencies that amplified it, and the durable lessons for any payment-critical firm.

When Hackers Hunted the WHO: Cyberattacks in a Pandemic’s First Weeks

Post author:Prabhu Kalyan Samal
Post published:March 24, 2020
Post category:Identity & Phishing Security

On 24 March 2020, Reuters reported that hackers had stood up a near-identical malicious imitation of the World Health Organization's internal email portal, infrastructure aimed at stealing passwords from staffers coordinating the global pandemic response. The same reporting documented that around 450 active WHO email addresses and passwords, plus thousands more belonging to people working on the COVID-19 response, had been leaked online. It was not an isolated incident but part of a documented surge in targeting of health bodies that spring. This piece reconstructs the verified incidents of March 2020 and the wider lesson that crisis response organizations are priority intelligence targets.