Decipher Files archive
30 / 58Every analysis in one list, newest first. Filter by vertical.
- CrowdStrike Falcon Channel File 291: How a Sensor Update Bricked 8.5M Windows Machines The CrowdStrike Channel File 291 incident is the cybersecurity supply chain event that proved EDR auto-update is itself a tier-zero risk.Cyber · July 19, 2024
- Snowflake Breaches 2024: Ticketmaster, AT&T, Santander Hit via Customer-Side Credentials The 2024 Snowflake customer breaches are the cybersecurity case study that proved cloud data warehouse security depends on customer-side identity hygiene, not…Cyber · May 2024 to August 2024
- National Public Data 2024: 2.9 Billion Records Including SSNs Posted on Hacking Forums The National Public Data incident is the cybersecurity data-broker case study that exposed how a single small company aggregated 2.9 billion records of US, UK,…Cyber · Late 2023 breach, April 2024 public exposure
- Polyfill.io Supply Chain (June 2024): How One Acquired CDN Compromised 100K+ Websites The Polyfill.io supply chain incident is the cybersecurity case study that proved JavaScript CDN domain ownership is a tier-zero supply chain control.Cyber · February 2024 acquisition, June 2024 disclosure
- Salt Typhoon 2024: Chinese State Actors Inside AT&T, Verizon, Lumen Wiretap Systems Salt Typhoon is the cybersecurity intrusion that gave Chinese state actors access to lawful-intercept and wiretap systems inside the largest US telecom carrier…Cyber · Discovery October 2024, dwell time months to years
- Halliburton Ransomware (Aug 2024): RansomHub Hit US Oilfield Services Giant Halliburton, the second-largest oilfield services company in the world, disclosed a ransomware attack on August 21, 2024 via SEC Form 8-K.Cyber · August 21, 2024 disclosure with multi-week recovery
- Transport for London Cyberattack (Sep 2024): 17-Year-Old Arrested, Oyster Data Exposed Transport for London (TfL), the agency that runs the London Underground, buses, and Overground, disclosed a cybersecurity incident on September 2, 2024.Cyber · September 1 to October 2024 with ongoing remediation
- Microsoft Midnight Blizzard (Jan-Apr 2024): Russian SVR Password-Sprayed Corporate Email Microsoft disclosed on January 19, 2024 that Russian SVR-affiliated actor Midnight Blizzard (APT29) had accessed Microsoft corporate email accounts including t…Cyber · November 2023 through April 2024 disclosure cycle
- Disney Slack Leak (Jul 2024): NullBulge Exfiltrated 1TB via Crypto-Malware Insider On July 12, 2024 a self-described hacktivist group calling itself NullBulge published approximately 1.1 terabytes of internal Disney Slack data covering thousa…Cyber · Pre-July 2024 compromise, July 12 public disclosure
- AT&T Call and Text Metadata Breach (Jul 2024): ~110M Records on Stolen Snowflake Tenant AT&T filed an SEC Form 8-K on July 12, 2024 disclosing that call and text metadata for nearly all wireless customers and customers of certain mobile virtual ne…Cyber · April 14 to April 25, 2024 exfiltration, July 12 disclosure
- Volt Typhoon (Feb 2024 CISA Advisory): PRC Pre-Positioning in US Critical Infrastructure CISA, NSA, FBI, and partner agencies in the UK, Australia, Canada, and New Zealand issued joint cybersecurity advisory AA24-038A on February 7, 2024, formally…Cyber · Pre-positioning over multiple years through February 2024 advisory
- Ascension Health Ransomware (May 2024): Black Basta Took Down 140 Hospitals Ascension, one of the largest non-profit Catholic health systems in the US with approximately 140 hospitals across 19 states, detected a ransomware attack on M…Cyber · May 8 to June 14, 2024 EHR downtime
- Sisense BI Breach (Apr 2024): CISA Emergency Advisory Forces Mass Credential Rotation On April 11, 2024 CISA issued an emergency advisory directing Sisense customers to immediately reset credentials and secrets shared with Sisense, after a confi…Cyber · Pre-April 2024 compromise, April 11 CISA advisory and customer notifications
- Change Healthcare Re-Extortion (Apr 2024): Ransom Did Not End the Incident Following the February 21, 2024 ALPHV/BlackCat ransomware attack on UnitedHealth Group subsidiary Change Healthcare, UHG paid approximately $22 million to the…Cyber · February 21, 2024 ransomware to April 2024 re-extortion through 2025 notification
- CDK Global Ransomware (Jun 2024): 15,000 US Auto Dealerships Offline for 10+ Days CDK Global, a dealer management software vendor used by approximately 15,000 US automotive and powersports dealerships, was hit by ransomware on June 19, 2024.Cyber · June 19 to early July 2024 with partial restoration through July
- Snowflake UNC5537: How Stolen Infostealer Credentials Drained 165 Customer Tenants The Snowflake UNC5537 campaign is the cybersecurity credential-theft event that proved single-factor SaaS access is a tenant-wide liability.Cyber · April 2024 to June 2024
- Change Healthcare Ransomware (Feb 2024): ALPHV via Unprotected Citrix The Change Healthcare ALPHV incident is the cybersecurity ransomware attack that froze US pharmacy and provider claims processing for weeks.Cyber · February 2024 to ongoing 2024
- Storm-0558 (2023): Stolen Microsoft Signing Key, Federal Email Access The Storm-0558 incident is the cybersecurity Microsoft cloud breach that put a stolen consumer signing key inside government email.Cyber · May 2023 to July 2023 (disclosure)
- Okta Support Breach 2023: 1Password, Cloudflare, BeyondTrust Timeline The Okta support breach is the cybersecurity incident that proved customer support uploads carry production session tokens.Cyber · September 2023 to October 2023
- 3CX Supply Chain: How Lazarus Chained Two Software Vendors in One Campaign The 3CX supply chain incident is the cybersecurity attack that linked two trojanized software vendors in a single Lazarus campaign.Cyber · January 2023 to April 2023
- LastPass: How a Two-Stage Breach Reached the Encrypted Customer Vaults The LastPass incident is the cybersecurity password manager breach that proved a developer endpoint compromise can reach encrypted customer vaults.Cyber · August 2022 to February 2023
- Uber Breach 2022: MFA Fatigue Push-Bombing of a Contractor Account The Uber 2022 breach is the cybersecurity MFA fatigue case study that defined push-bombing as a named technique.Cyber · September 2022
- Microsoft Midnight Blizzard: Password Spray Reaches Senior Leadership Email The Microsoft Midnight Blizzard incident is the cybersecurity Russian SVR campaign that read Microsoft executive email through a forgotten test tenant.Cyber · November 2023 to January 2024
- Okta Lapsus$ Breach (Jan 2022): Sitel Contractor Access Timeline The Okta Sitel incident is the cybersecurity identity provider breach that exposed how subcontracted support reaches customer tenants.Cyber · January 2022 to March 2022
- XZ Utils CVE-2024-3094: A Three-Year Social Engineering Path into SSH The XZ Utils CVE-2024-3094 incident is the cybersecurity supply chain attack that exposed open source maintainer pressure as an attack vector.Cyber · 2021 to March 2024
- SolarWinds Sunburst: How Supply Chain Compromise Bypassed Every Endpoint Defense The SolarWinds Sunburst incident is the cybersecurity supply chain compromise that defined the modern threat landscape.Cyber · March 2020 to December 2020 (disclosure)
- Colonial Pipeline DarkSide: When OT Met Ransomware-as-a-Service The Colonial Pipeline DarkSide incident is the cybersecurity ransomware attack that exposed the fragility of US fuel infrastructure.Cyber · April 2021 to May 2021
- MOVEit Cl0p Cascade: How One Zero-Day Compromised Federal Agencies and Fortune 500 The MOVEit Cl0p incident is the cybersecurity zero-day exploitation campaign that turned a managed file transfer product into a mass data theft pipeline.Cyber · May 2023 to August 2023
- MGM Resorts Breach 2023: Scattered Spider Vishing, ALPHV Ransomware The MGM Resorts Scattered Spider incident is the cybersecurity attack that proved a 10-minute phone call can ground a Las Vegas casino.Cyber · September 2023
- CrowdStrike Falcon: When the Defender's Update Became the Outage The CrowdStrike Falcon incident is the cybersecurity supply chain failure that grounded airlines, broadcasters, and hospitals worldwide.Cyber · July 2024
Next step
- Free practice for the ISC2 CC exam
ISC2 CC covers the security baseline this topic builds on: threats, access control, secure design and operations.
- Full analysis for the ISC2 CC exam, $39 once
The right answer, explanation and source for every question, your readiness by domain and a study plan. One payment, no subscription, 30-day full refund.
What is free and what costs money · All exams
A weekly cybersecurity career email
Threats, the job market, salary data and career strategy. It stops with one click.
By subscribing you agree to our privacy policy. Unsubscribe anytime.