Target 2013: the theft of 40 million cards via an HVAC vendor
In 2013, attackers breached Target through an HVAC contractor and stole 40 million cards — the attack that redefined …
Supply Chain 10 posts
Information security in plain English: scams, hardening and privacy — plus retrogaming, games and geek culture.
Slopsquatting: the scam built on packages AI invents
Coding assistants suggest npm and pip packages that don't exist — and criminals register those names with malware …
Data poisoning: what it is and how attackers poison AI models
Data poisoning corrupts AI models by injecting malicious data into training. How the attack works and why it stays …
How formjacking steals your card data without you noticing
Formjacking injects malicious JavaScript into payment forms to capture your data in real time. Understand how the attack …
Jscrambler attack: hackers poison NPM packages
Hackers used leaked NPM credentials in a massive supply chain attack. How the Jscrambler case exposes the soft …
NotPetya: the US$10 billion cyberattack, 9 years on
On 27 June 2017, a wiper disguised as ransomware left Ukraine and caused US$10 billion in damage. Maersk, Merck and …
Miasma: supply chain worm infects 32 Red Hat npm packages
On 1 June, the Miasma worm compromised 32 Red Hat npm packages and stole AWS, Azure, GCP and Kubernetes credentials …
MOVEit: 3 years on from the zero-day that exposed 93 million records
On 31 May 2023, CVE-2023-34362 in MOVEit Transfer became the largest supply chain attack by SQL injection in history, …
GitHub hacked via a VS Code extension: the TeamPCP case
A corrupted VS Code extension was live for 18 minutes and cost GitHub 3,800 internal repositories. Here's how that …
Trellix hacked: source code from McAfee+FireEye stolen
RansomHouse accessed Trellix's repository in April and stole source code from the company that protects 50,000 …