Cyber Attack History

Sisense Breach: CI Credentials, AWS Keys and a CISA Advisory

Post author:Prabhu Kalyan Samal
Post published: September 5, 2026
Post category:Cloud & Infrastructure Security Supply Chain Security

On April 24, 2024, CISA and the FBI advised every Sisense customer to rotate credentials after attackers compromised the BI vendor’s development environment — and by week’s end, Sisense-issued AWS keys were circulating publicly. This piece reconstructs the five-day arc from detection to contained, explains why business-intelligence platforms are credential funnels that turn vendor CI/CD breaches into customer incidents, and extracts the third-party-risk doctrine the episode left behind for every embedded-analytics supply chain.

Change Healthcare ALPHV: The Ransomware That Broke US Healthcare

Post author:Prabhu Kalyan Samal
Post published: September 5, 2026
Post category:Emerging Tech & Architecture Ransomware & Malware Security

One ALPHV/BlackCat intrusion in February 2024 froze claims and pharmacy payments across US healthcare for weeks — the single most consequential ransomware attack of the year. This account covers the nine-day dwell time, the $22 million ransom payment and the exit-scam double-cross that brought RansomHub back for seconds, the eventual disclosure of hundreds of millions of records, and why one processor’s central position converted a single encryptor into a national healthcare liquidity crisis.

MGM, Caesars, and Scattered Spider: The Vishing Fall of 2023

Post author:Prabhu Kalyan Samal
Post published: September 5, 2026
Post category:Cloud & Infrastructure Identity & Phishing Security

In September 2023 Scattered Spider vished the MGM helpdesk, pivoted through Okta to ESXi, and detonated ALPHV ransomware — a $100M quarter for MGM while Caesars paid up. The reference incident for helpdesk verification, MFA fatigue, and pay-vs-rebuild economics.

Discord.io Breach: When Brand Adjacency Becomes Attack Surface

Post author:Prabhu Kalyan Samal
Post published: September 5, 2026
Post category:Identity & Phishing Security

Roughly 100,000 Discord.io user accounts were dumped for sale in August 2023 — and the confusion with Discord itself proved that brand-adjacent third parties are breach surface for your users even when your systems are never touched.

Citrix NetScaler CVE-2023-3519: Breached Before the Advisory

Post author:Prabhu Kalyan Samal
Post published: September 5, 2026
Post category:Cloud & Infrastructure Security Web & API Security

The July 2023 NetScaler ADC/Gateway pre-auth RCE hit government networks as a true zero-day — and post-patch webshell persistence taught defenders that appliance remediation means rebuild, not upgrade.

Storm-0558 Forged-Token Breach: The Stolen Key That Read Government Email

Post author:Prabhu Kalyan Samal
Post published: September 5, 2026
Post category:Cloud & Infrastructure Identity & Phishing Security

China-linked Storm-0558 forged Azure AD tokens with a stolen Microsoft consumer signing key and read email at ~25 organizations including the State and Commerce departments — exposing vendor key hygiene, token scope validation, and log-tiering as board-level security questions.

MOVEit’s Ledger: 2,700 Orgs, 93 Million People

Post author:Prabhu Kalyan Samal
Post published: September 5, 2026
Post category:Security Supply Chain Security Web & API Security

Cl0p’s June 2023 listing waves turned the MOVEit breach into a running census — 2,700+ organizations and ~93M individuals per Emsisoft tallies. The economics of encryption-free extortion.

Papercut RCE 2023: Print Servers as the Softest Door

Post author:Prabhu Kalyan Samal
Post published: September 5, 2026
Post category:Cloud & Infrastructure Security Web & API Security

CVE-2023-27350 gave unauthenticated RCE on PaperCut MF/NG servers across schools and hospitals, with access handed toward ransomware crews.

MSI’s BootGuard Key Leak: Hardware Trust on the Market

Post author:Prabhu Kalyan Samal
Post published: September 5, 2026
Post category:Cryptography & PKI Security Supply Chain Security

MSI’s ransomware extorted Intel BootGuard OEM signing keys onto underground markets — keys that certify firmware as bootable. Key ceremony lessons.

Namecheap/SendGrid Hijack: Phishing With Perfect DMARC

Post author:Prabhu Kalyan Samal
Post published: September 5, 2026
Post category:Identity & Phishing Security Supply Chain Security

Phishers compromised a SendGrid supplier account and sent MetaMask-themed mail through Namecheap’s legitimate pipeline — SPF, DKIM, and DMARC all passed.

The ChatGPT Redis Bug: Cross-Tenant Leaks in One Line

Post author:Prabhu Kalyan Samal
Post published: September 5, 2026
Post category:AI & Agent Security Cloud & Infrastructure Security

A redis-py cancellation bug plus a disabled key-prefix let some ChatGPT users see strangers’ chat titles and billing data. Multi-tenant cache lessons.