Breaches, scams and the people and processes attackers target. Sourced cases, regulation and practical defenses for security teams and ordinary users.
233 posts, newest first. Page 1 of 8.
Tags in this track:CybersecuritysecurityScamsfraudphishingsocial engineeringAccount TakeoverSIM SwapCISOcompliancePrivacyregulationsGovernance
Latest in Scams & Cybersecurity
Colorado's AI Act was repealed and rewritten, and the big deployer obligations start 1 January 2027. What Texas, Illinois, NYC, Utah and California require today, from the statute text.
Read the article
You can work through a full personal security checklist in one weekend if you go in order of impact: accounts, phone number, and devices on Saturday, then credit freezes, a family safe word, data broker opt-outs, and backups on Sunday.
US clocks fall back at 2 a.m. on Sunday, November 1, 2026. British Columbia, Alberta, Manitoba and the NWT will not. City-by-city times, the law, and what breaks in software.
Data brokers hold a profile of nearly every US adult. This free, browser-only check estimates how exposed you are and gives you an opt-out plan, with nothing leaving your device.
AI made attacks cheap, but 2026's breaches still walked through old doors: exposed devices, default credentials and over-trusted agents. Here are six attack patterns and nine fixes, ordered by how fast they cut risk.
AI agents are reaching production while security budgets grow 4%. How to use The CISO Desk benchmark cards, tool overlap analyzer and templates to write a 2027 memo that funds agent security by reallocation, with a copyable template.
A curator's guide to choosing security podcasts by role. For SOC, AppSec, cloud, offensive security, GRC, leadership and identity: what the role needs from audio, two or three picks with ownership noted, one standout episode, and where the full list lives.
A week-by-week security podcast plan for university, bootcamp and self-taught students: one short daily news show, two or three named episodes a week, and a phase on identity, MFA and passkeys. Mapped to Security+, CySA+ and the CISSP.
Scattered Spider never broke MFA. It phoned the help desk and had MFA moved. What MGM, Caesars, TfL and M&S disclosed, what the Scam Atlas sourced cases show, and a short reset checklist for IT teams.
Americans reported $20.9 billion in scam losses to the FBI in 2025, and phishing was only about 1% of it. Investment and trust scams took the most, especially from older relatives. Here is what the numbers mean for your family, and how to use the Scam Atlas to spot and report a scam.
The 2026 Big Tech enforcement record in one place: four penalties worth about $14.1B, led by US states rather than Brussels, and dominated by children's safety. Here is what the Tech Fines tracker shows and how to follow it.
Picking an age verification vendor is the last decision, not the first. The duty you are actually under, the methods ladder, the one-bit record, and where the age claim lives in your identity model.
ISO 42001 went from obscure standard to procurement line item in about eighteen months. It does not certify that your model is safe, and the certificate scope is where buyers consistently misread it.
More than half of BIMI records are broken and nobody got an error. Silent failure is a whole category of security control, and most of yours are in it.
Email, AI agents, media files, and build artifacts all got cryptographic verification in 2026. Same architecture, same failure modes, same mistake.
CrowdStrike clocks 29-minute breakout times and an 89% surge in AI-augmented attacks. Here is the five-phase framework I use with CISOs to close that gap, with budget splits and a board script.
Most cybersecurity vendors sell to the CISO and lose the deal to a security engineer they never spoke to. Security purchases are committee decisions with an asymmetric structure: many people can kill a deal, few can approve one. Here is how it actually works.
CVE, CWE, CAPEC, ATT&CK, CVSS, KEV, ATLAS. The security taxonomy acronyms get used interchangeably and they should not be. Here is what each one actually does, how they chain together, and why they matter more for your content strategy than most security marketers realize.
Three RFPs out, three decks back, cheapest bid wins, and six months later you are over budget. The problem is the selection process, not the firms.
An enterprise prospect just asked for your SOC 2. Here is what the report really is, Type I vs Type II, the ten policies auditors expect, and how Vanta and Drata changed the work.
On System Administrator Appreciation Day, appreciation for the people who hold the literal keys to the organization, and why identity work matters more, not less, in the AI era.
Both are free, fast, and encrypted. The real differences are what they block, what they log, and whose laws govern the servers.
ShinyHunters claimed 2.2M Kodak records with a June 18 leak deadline. The group has breached Snowflake, Salesforce, Canvas, PeopleSoft, and now Kodak.
One phished BPO agent extracted 13M Adobe customer records and unpublished vulnerability reports from HackerOne. Third-party access is the breach pattern of 2026.
Iranian hackers wiped tens of thousands of Stryker devices in one attack. No data stolen. Just destruction. A new phase in state-sponsored cyber warfare.
Novo Nordisk confirmed a June 2026 data breach. The pharmaceutical giant behind Ozempic becomes the latest healthcare target in an accelerating trend.
74,000 Fortinet admin credentials cracked by GPU clusters from config backups stolen via old vulnerabilities. Patching the device wasn't enough.
ShinyHunters breached Canvas LMS through a free teacher account flaw. Instructure paid the ransom. Data was already copied. 275M student records exposed.
France banned Signal for government use and built Tchap. A hacker stole 73K accounts, 643K messages, and 59K media files from French ministry conversations.
24 billion stolen credentials in one database. 8.3TB of plaintext passwords and login URLs harvested by infostealers. The credential economy has scaled.
ShinyHunters weaponized a PeopleSoft zero-day to breach 100+ organizations in two weeks. 455K student records at Nottingham alone. Oracle's advisory came last.
New writing on identity, AI security, and building software, delivered when it ships. No tracking pixels, no funnels, unsubscribe with one click.
