InfraGard Portal Breach: Account Takeover Inside the Vetted
USDoD hijacked a chapter president’s InfraGard account and listed 87,000 members’ PII for sale. Identity lessons for trusted-community portals.
Uber’s 2022 Hack: A Bought Password, a Flood of Pushes, and vSphere
An 18-year-old bought a contractor’s Uber password, bombarded them with MFA pushes until one was approved, then roamed to vSphere via hardcoded credentials.
Guardian Ransomware: The Newsroom That Kept Printing
Ransomware forced the Guardian’s newsroom off its networks for weeks in late 2022 — yet print and web kept publishing. Editorial continuity lessons.
Text4Shell: The 9.8 Severity Score That Wasn’t Log4Shell
CVE-2022-42889 in Apache Commons Text scored CVSS 9.8 but needed apps to interpolate attacker strings — most never did. The reachability-triage lesson.
Medibank 2022: The Ransom Refusal That Published Patients
Criminals entered Medibank via a contractor’s VPN credentials on a gateway without MFA, then dumped 9.7M customers’ health data after the ransom refusal.
Fortinet CVE-2022-40684: Admin Access Without a Password
A CVSS 9.8 authentication bypass let attackers add their own SSH keys to FortiOS admin accounts via crafted HTTPS requests. Exploited at disclosure.
Optus 2022: 9.8M Records, One Unauthenticated API, Zero Exploits
Australia’s second-largest telco exposed ~9.8M customer records via an API left unauthenticated in production. No zero-day, no phishing — just enumeration.
FortiOS SSL-VPN Heap Overflow: Pre-Auth Emergency
CVE-2022-42475 was a CVSS 9.8 pre-auth heap overflow in FortiOS SSL-VPN, patched silently then confirmed exploited. Edge memory safety lessons.
LastPass 2022: The Dev-Environment Breach That Came Back
August’s ‘contained’ developer-account compromise returned in December as stolen vault backups. Inside the two-act breach.
Plex’s 15M Credential Leak: When Your Forum Post Becomes a Combo List
A forums database with bcrypt hashes and salts hit a criminal forum. The real blast radius was everywhere else users reused passwords.
Solana’s 9,000-Wallet Drain: Who Logged the Seed Phrases?
Slope’s telemetry backend held plaintext seed phrases, and attackers harvested them. The chain saw only valid signatures — and that is the whole lesson.
Twitter’s 5.4M Scrape: When an API Becomes a Breach Oracle
A patched OAuth endpoint answered one question too honestly: which phone belongs to which handle. The dataset sold for $30k — the class lesson is still with us.