Incidents & Vulnerabilities
Capital One, Equifax, Log4Shell, Heartbleed, XZ — public breaches and vulnerabilities broken down into cause, impact, first response, and prevention, for the lessons that still apply.
Tsurugi Handa Hospital ransomware (2021) — an unpatched VPN CVE and backups encrypted along with production
The way in, per the expert committee's report, was an internet-facing VPN device left unpatched against a known vulnerability (CVE-2018-13379), reachable with leaked credentials. Short passwords, no account lockout, and users holding admin…
Osaka General Medical Center ransomware (2022) — a contractor's VPN as the way in, and hospital BCP
The way in was not the hospital itself but a meal-service contractor's remote-maintenance VPN device, which was unpatched and reachable using leaked credentials, the investigation committee found. Because the hospital and contractor were co…
7pay fraud (2019): the disclosed cause assessment and account protections
7pay suffered unauthorized account access in July 2019. The August 1 company statement assessed credential stuffing as likely and recorded 808 affected people and ¥38,615,473 as of July 31 at 17:00, including unauthorized top-ups and use. I…
Benesse Data Leak (2014) — Why an Insider Couldn't Be Stopped, and the Least-Privilege Defense
A dispatched systems engineer at an outsourced group company used legitimately granted database access to copy customer data in bulk, transfer it to a personal smartphone, and sell it to data brokers. The monitoring software blocked writes…
Capcom Ransomware (2020) — Why an Old VPN Device Was the Way In, and the Double-Extortion Defense
The way in was an old backup VPN device that had been left running at a North American subsidiary after newer units replaced it. From there the network was breached, data was stolen, and then ransomware encrypted systems (double extortion).…
Coincheck NEM Heist (2018) — How ~$530M Was Stolen, and the Key-Management Defense
The entry point was reported to be spear-phishing / malware aimed at employees, which stole the private key of an internet-connected hot wallet; ~523 million XEM (~$530M at the time) was then moved out in a single transfer. The core failure…
KADOKAWA / Niconico Ransomware (2024) — Why It Spread Company-Wide, and Network Segmentation & BCP
The way in was described as phishing that stole an employee's credentials; from there the internal network was breached and ransomware ran, taking down many of the group's services (including Niconico) for months and leaking ~250,000 people…
Takufile-bin Data Leak (2019) — Why Plaintext Password Storage Is Fatal, and the Hashing Defense
A server vulnerability was exploited for unauthorized access, and ~4.8 million records (names, emails, login passwords, dates of birth, including withdrawn customers) leaked. The decisive failure was that login passwords were stored unencry…
MOVEit mass breach (2023) — how a SQL injection zero-day reached 2,700+ orgs, and how to defend
The entry was a SQL injection zero-day (CVE-2023-34362) in the internet-facing MOVEit Transfer. A web shell (LEMURLOOT) was planted and data was bulk-stolen from the backing database, hitting 2,700+ orgs and ~93.3M people. Most victims were…
Capital One breach (2019) — how SSRF leaked 100M+ records, and how to defend
A single SSRF reached the metadata endpoint → over-privileged IAM temporary credentials → bulk S3 copy, leaking ~106M records. Every step could have stopped it. In your environment: IMDSv2, IAM least privilege, and an allowlist for outbound…
Codecov breach (2021) — when a CI tool was tampered with and secrets leaked
A trusted CI tool (the curl|bash Bash Uploader) was altered upstream. Because your own code was untouched, it went unnoticed for ~2 months while CI secrets leaked; a checksum check caught it. In your CI: verify fetched artifacts, least-priv…
Equifax breach (2017) — how an unpatched Apache Struts flaw leaked 147M people
The cause was a known, already-patched CVE (CVSS 9.8) left unapplied on a public system. An expired monitoring certificate hid the exfiltration for 76 days. In your environment: asset inventory, a patch SLA, machine monitoring, and healthy…
Heartbleed (CVE-2014-0160) — an OpenSSL bug that leaked server memory
OpenSSL's memory over-read could leak private keys and sessions. The cause: the server trusted a claimed length and read adjacent memory. The lesson: act as if it all leaked (re-issue certificates, rotate all secrets), monitor widely used b…
Log4Shell (CVE-2021-44228) — a logging library flaw, and why teams couldn't quickly tell if they used it
Log4j's CVSS 10.0 bug. The core problem was the transitive dependency: being affected through a library you didn't know you used. A passive logging path became an attack vector. SBOM, machine-monitoring, fast patching, and following the fol…
The XZ Utils backdoor (CVE-2024-3094) — a supply-chain attack by a trusted co-maintainer
A trusted maintainer planted a backdoor in xz, a supply-chain attack. One engineer noticed logins were slow and found it just before stable releases. Code wasn't the target; people and trust were. Minimize dependencies, pin versions, build…