Security
Learning platform goes down during finals with a ransom note on screen
The system used by universities suffered a breach and an outage displaying a note to every user.
A university platform went down during finals with a ransom note
The company chose to patch rather than negotiate and faced retaliation at the worst moment. The same month, a security firm had its source code accessed and the annual report found 96% of victims were small businesses.
Security
A security company has its source code repository accessed
The vendor serves more than 50,000 corporate and government customers. What leaked was the code itself.
From the studio
The typical victim isn't the one in the headline
The annual breach report published this month carried a number that contradicts the perception built by the press: 96% of ransomware victims are small and medium-sized businesses, and incidents originating with suppliers rose 60%.
The distortion has a simple explanation. An attack on a well-known company is news, an attack on a thirty-person company isn't. The result is a public picture where the problem looks like a big-company issue, and a reality where it's almost entirely everyone else's.
The month's cases show the mechanics. An academic platform went down during final exams. A security company had its own source code accessed. A franchisee document system handed over hundreds of thousands of records. In none of them was the final target the company hit: it was whoever depended on it.
The list that changes the outcome is short, cheap and tedious: two-step authentication, automatic updates, backups tested with an actual restore, and an inventory of what each connected supplier can see. None of the month's incidents would have been prevented by a new tool alone.
In this issue
Data
Annual report finds 96% of ransomware victims are small businesses
The study also records a 60% rise in incidents originating with third parties.
Security
Electronics manufacturer confirms attack with a claim of 11 million records
The group responsible claimed a data volume the company did not confirm.
Security
Convenience chain notifies breach in franchisee document systems
Attackers reached the administrative repository holding contracts and partner documents, the system nobody treats as critical.
Security
A supplier attack exposes the link nobody audits
Customers assess their own systems and inherit the security posture of whoever they hired.
Data
Third-party incidents rise 60% in a year
The annual report's figure describes a risk internal assessment can't see.
Security
Patching instead of negotiating has a visible cost and is the right call
Retaliation after the fix shows the pressure attackers apply once they lose leverage.
Work
System seasonality decides when an attack hurts most
An academic platform during exam week is the example, and the logic applies to any operation.
Security
Security tools run with high privilege, which makes them better targets
Access to a security vendor's code is worth more than access to an ordinary system.
Data
Small companies are the typical victim, not the exception
The report's figure inverts the perception created by coverage of attacks on large firms.
Security
The attacker's number and the company's confirmation rarely match
The gap isn't accidental: each side has opposite incentives when publishing volume.
Work
Incident response works when the contract was already signed
The companies that contained fast had their process ready before the attack.
Work
An integration inventory is the task nobody does and everyone needs
Listing what's connected and what each one reaches fits in a morning and changes the damage.
Security
The year's campaign has a fixed method and interchangeable targets
The same group appears across unrelated sectors, always targeting platforms many share.
Work
What a month of incidents leaves as a practical list
Five distinct cases, one small set of measures that would have changed the outcome.
Sections