#insider-threat

Core infrastructure engineer Daniel Rhyne got 32 months for planting scheduled tasks on his employer's domain controller that deleted 13 domain admins and reset passwords across 254 servers and 3,284 workstations, then demanding 20 bitcoin. A reused password and a rogue VM gave him away.

South Africa's air navigation provider ATNS found ransomware-linked malware in an OT network supporting aviation weather services, with suspected data exfiltration to China-based IPs. No flights were disrupted; the actor is unknown and a forensic probe is under way.

Three men who worked in incident response ran BlackCat attacks. One of them was simultaneously negotiating on behalf of ransomware victims — and passing the attackers his own clients' insurance limits.

In July 2019, Capital One Financial Corporation formally disclosed one of the most significant data breaches in the history of the financial services sector. The security incident resulted in the...