Incidents & Vulnerabilities
Capital One, Equifax, Log4Shell, Heartbleed, XZ — public breaches and vulnerabilities broken down into cause, impact, first response, and prevention, for the lessons that still apply.
Tsurugi Handa Hospital ransomware (2021) — an unpatched VPN CVE and the backup trap
The way in, per the expert committee's report, was an internet-facing VPN device left unpatched against a known vulnerability (CVE-2018-13379), reachable with leaked credentials. Short passwords, no account lockout, and users holding admin rights made lateral movement easy. Decisively, the primary system and its backup were on the same network and both were encrypted — a backup that isn't isolated and offline is no backup when it counts. EMR recovery took about two months. Defend by patching internet-facing VPNs fast, revoking leaked/reused credentials, and keeping isolated, offline, 3-2-1 backups.
Osaka General Medical Center ransomware (2022) — a contractor's VPN as the way in, and hospital BCP
The way in was not the hospital itself but a meal-service contractor's remote-maintenance VPN device — unpatched, and reachable using leaked credentials — the investigation committee found. Because the hospital and contractor were constantly connected, and because servers/PCs shared passwords, users held broad admin rights, EMR servers lacked antivirus, and the network wasn't segmented, the encryption spread across the EMR system. Outpatient care, surgery, and emergency intake were restricted; full recovery took over two months. Defend by treating contractor links as your own attack surface: patch internet-facing VPNs, end credential reuse, least privilege, segment, and build a medical BCP (paper fallback, tested restore).
7pay Fraud (2019) — How a Payment App With No 2FA Got Taken Over
Account takeovers began the day after launch; ~808 users lost ~¥38.6M. The core failure was authentication design: (1) no two-factor authentication, so login needed only ID + password, and (2) a password reset that could send the new password to an email address other than the registered one — so fragments of personal data were enough to hijack an account. Defend by requiring 2FA on sensitive actions, restricting password reset to registered channels, detecting and locking credential-stuffing, and having auth flows reviewed by a second set of eyes before launch.
Benesse Data Leak (2014) — Why an Insider Couldn't Be Stopped, and the Least-Privilege Defense
A dispatched systems engineer at an outsourced group company used legitimately granted database access to copy customer data in bulk, transfer it to a personal smartphone, and sell it to data brokers. The monitoring software blocked writes to USB storage but did not block transfer to a smartphone (MTP). Up to ~35 million records leaked. Defend by minimizing privilege (least privilege / need-to-know), closing every exfiltration path with DLP, detecting bulk access, and extending oversight all the way to contractors and sub-contractors.
Capcom Ransomware (2020) — Why an Old VPN Device Was the Way In, and the Double-Extortion Defense
The way in was an old backup VPN device that had been left running at a North American subsidiary after newer units replaced it. From there the network was breached, data was stolen, and then ransomware encrypted systems (double extortion). Up to ~390,000 people's personal data was potentially exposed (no payment-card data). Capcom refused to pay, restored from backup, and disclosed transparently. Defend by decommissioning unused gear, patching edge devices, and covering both theft and encryption (segmentation, detection, backups).
Coincheck NEM Heist (2018) — How ~$530M Was Stolen, and the Key-Management Defense
The entry point was reported to be spear-phishing / malware aimed at employees, which stole the private key of an internet-connected hot wallet; ~523 million XEM (~$530M at the time) was then moved out in one sweep. The core failure was keeping a huge, instantly-spendable balance 'hot' and with no multisig — a single stolen key moved almost everything. Defend by keeping important keys cold / in a dedicated vault, minimizing the hot balance, removing single points of failure (multi-approval), and detecting and stopping abnormal bulk operations.
KADOKAWA / Niconico Ransomware (2024) — Why It Spread Company-Wide, and Network Segmentation & BCP
The way in was described as phishing that stole an employee's credentials; from there the internal network was breached and ransomware ran, taking down many of the group's services (including Niconico) for months and leaking ~250,000 people's data. Reporting and analysis attribute the company-wide spread to systems of very different criticality sharing the same network — reportedly with too little segmentation. Defend by segmenting the network by criticality, using phishing-resistant authentication, and preparing business continuity (BCP) and recovery.
Takufile-bin Data Leak (2019) — Why Plaintext Password Storage Is Fatal, and the Hashing Defense
A server vulnerability was exploited for unauthorized access, and ~4.8 million records — names, emails, login passwords, dates of birth, including withdrawn customers — leaked. The decisive failure was that login passwords were stored unencrypted, in plaintext: leaked, they were immediately usable and fed account-takeover on other sites via password reuse. Defend by storing passwords as a one-way salted hash, holding no data you don't need, patching vulnerabilities, and preparing for reuse (2FA).
MOVEit mass breach (2023) — how a SQL injection zero-day reached 2,700+ orgs, and how to defend
The entry was a SQL injection zero-day (CVE-2023-34362) in the internet-facing MOVEit Transfer. A web shell (LEMURLOOT) was planted and data was bulk-stolen from the backing database, hitting 2,700+ orgs and ~93.3M people. Most victims were pulled in indirectly because a vendor used MOVEit. In your environment: KEV fast-patching, minimize exposure, web↔DB least privilege and segmentation, vendor inventory and data minimization.
Capital One breach (2019) — how SSRF leaked 100M+ records, and how to defend
A single SSRF reached the metadata endpoint → over-privileged IAM temporary credentials → bulk S3 copy, leaking ~106M records. Every hop could have stopped it. In your environment: IMDSv2, IAM least privilege, and an allowlist for outbound fetches.
Codecov breach (2021) — when a 'trusted tool' in CI was hijacked and secrets leaked
A trusted CI tool (the curl|bash Bash Uploader) was altered upstream. Because your own code was untouched, it went unnoticed for ~2 months while CI secrets leaked; a checksum check caught it. In your CI: verify fetched artifacts, least-privilege secrets, rotation, egress monitoring.
Equifax breach (2017) — how an unpatched Apache Struts flaw leaked 147M people
The cause was a known, already-patched CVE (CVSS 10.0) left unapplied on a public system. An expired monitoring certificate hid the exfiltration for 76 days. In your environment: asset inventory, a patch SLA, machine monitoring, and healthy detection.
Heartbleed (CVE-2014-0160) — when memory leaked from the foundation of encrypted traffic
OpenSSL's memory over-read could leak private keys and sessions. The cause: the server trusted a claimed length and read adjacent memory. The lesson: act as if it all leaked — re-issue certificates, rotate all secrets — plus the weight of foundational software and memory safety.
Log4Shell (CVE-2021-44228) — the night the world feared a bug it couldn't even confirm it had
Log4j's CVSS 10.0 bug. The real fear was the transitive dependency — being affected through a library you didn't know you used. A passive logging path became an attack vector. SBOM, machine-monitoring, fast patching, and following the follow-up CVEs are the lessons.
The XZ Utils backdoor (CVE-2024-3094) — when trust itself was the target
A trusted maintainer planted a backdoor in xz — a supply-chain attack. One engineer's 'this feels slow' caught it just before stable. Code wasn't the target — people and trust were. Minimize dependencies, pin versions, build reproducibly, chase anomalies, and support maintainers.