Every one of these made the news. None of them needed a genius. Each started with one ordinary gap that nobody had looked at from the outside. The same few roots keep coming back. Follow one to the breach it caused.
2013
Payment card details of 40 million shoppers were stolen from the tills of a US retail chain over the holiday season.
Root cause: a login belonging to the company's heating and air-conditioning contractor was stolen. Nothing separated the contractor's portal from the checkout systems.
2017
Personal records of 147 million people, including social security numbers, were taken from one of the three big US credit bureaus.
Root cause: a known flaw in the software behind one public website. The fix had been available for two months and had not been applied.
2018
Card details of around 400,000 customers were copied as they typed them into the airline's website and app.
Root cause: a few lines of malicious code were slipped into a script loaded by the payment page. Nobody was checking whether that script had changed.
2018
Records of up to 383 million hotel guests, including millions of passport numbers, were found to have been leaking for four years.
Root cause: the attackers were already inside Starwood's network when Marriott bought the company in 2016. Nobody looked for them before the two networks were joined.
2019
Credit card applications from more than 100 million people were downloaded from the bank's cloud storage.
Root cause: a misconfigured firewall on one cloud server let an outsider make that server hand over its own access keys. The keys opened the storage.
2020
The accounts of Barack Obama, Elon Musk, Apple and dozens of others posted the same bitcoin scam within minutes of each other.
Root cause: attackers phoned employees pretending to be the IT department and talked them into logging in on a fake page. That gave them Twitter's internal admin tools.
2020
Around 18,000 organisations, including several US government departments, installed a routine software update that carried a hidden back door.
Root cause: attackers got into the software maker's build system and added their code before the update was signed. Customers trusted the signature, as they were meant to.
2021
The largest fuel pipeline on the US East Coast shut down for six days, causing queues and shortages at petrol stations across several states.
Root cause: one password for an old VPN account that was no longer used but still worked. The password had appeared in an earlier leak, and the VPN asked for nothing else.
2022
A teenager gained access to Uber's internal systems, from its Slack to its cloud and security consoles, and announced it to staff.
Root cause: a contractor's password was bought online. The attacker then spammed the contractor with login approval prompts until one was accepted, and found admin passwords written in a script on a shared drive.
2022
Encrypted copies of millions of customers' password vaults were stolen from a password manager.
Root cause: an engineer's home computer was hacked through out-of-date media software. A keylogger on it captured the master password to the company's backups.
2023
Slot machines, room keys and check-in systems across Las Vegas casinos went down for about ten days. The company put the cost at around 100 million dollars.
Root cause: a ten-minute phone call to the IT help desk. The caller pretended to be an employee they had found on LinkedIn, and the help desk reset the login.
2023
Genetic and family-tree data on about 6.9 million people was collected and offered for sale.
Root cause: about 14,000 customers had reused passwords that were already leaked from other websites, and no second login step was required. A relatives feature then let each of those accounts view many others.
2024
Pharmacies and hospitals across the US could not process payments or prescriptions for weeks. Data on roughly 190 million people was taken.
Root cause: a stolen login for a remote-access server that did not ask for a second step. Once inside, the attackers had nine days to move around before deploying ransomware.
An old account that still worked. A supplier who could reach too far. A fix that was never applied. Each gap was visible from the outside long before anyone used it. Finding yours, before someone else does, is what we do.
