Case files · 106 cases · 16 episodes
How the heists happened
The full story behind each video: how they got in, how it was caught, and the one control that was missing. Grouped by the kind of gap that was left open.
Episode deep divesIdentity and accessVendors and third partiesPatching and monitoringPayments and fraudInsider riskBackups and recoveryGuides
Episode deep dives
The long-form episodes, written up chapter by chapter with a timeline and sources.
- Episode 01 · TARGET 2013
The Target breach, start to finish: a contractor's login, ignored alarms and 40 million cardsPremieres 2026-10-04 - Episode 02 · BANGLADESH BANK 2016
The Bangladesh Bank heist, start to finish: a fake job seeker, a dead printer and $81 millionPremieres 2026-10-07 - Episode 03 · EQUIFAX 2017
The Equifax breach, start to finish: a missed patch, an expired certificate and 147 million peoplePremieres 2026-10-11 - Episode 04 · COLONIAL PIPELINE 2021
The Colonial Pipeline hack, start to finish: one unused password, 5,500 miles shut and a bitcoin clawbackPremieres 2026-10-14 - Episode 05 · HOT LOTTO 2010
The lottery security chief who rigged five states, and the voice that gave him awayPremieres 2026-10-18 - Episode 06 · TWITTER 2020
Twitter 2020: the phone calls that hijacked Obama, Musk and GatesPremieres 2026-10-21 - Episode 07 · CAPITAL ONE 2019
Capital One 2019: one cloud firewall mistake, 106 million people and one tipPremieres 2026-10-25 - Episode 11 · WANNACRY 2017
WannaCry, start to finish: a leaked spy tool, an unapplied patch and a $10.69 off switchPremieres 2026-11-08 - Episode 12 · SONY PICTURES 2014
The Sony Pictures hack, start to finish: a wiped studio, a pulled film and a folder named PasswordPremieres 2026-11-11 - Episode 13 · UBER 2022
The Uber hacks, start to finish: a bought password, a tired yes and a security chief's convictionPremieres 2026-11-15 - Episode 14 · SEC X ACCOUNT 2024
The SEC's X account hack, start to finish: a fake ID, a phone store and a bitcoin jumpPremieres 2026-11-18 - Episode 15 · CHANGE HEALTHCARE 2024
The Change Healthcare attack, start to finish: one password, no second lock, 192.7 million peoplePremieres 2026-11-22 - Episode 16 · SNOWFLAKE 2024
The Snowflake breaches, start to finish: old stolen passwords, 165 companies and AT&T's call logsPremieres 2026-11-25 - Episode 17 · LASTPASS 2022
The LastPass breach, start to finish: a targeted engineer, stolen vaults and a $150 million theftPremieres 2026-11-29 - Episode 18 · SILK ROAD THEFT 2012
The Silk Road theft, start to finish: 50,000 bitcoin, 9 years and a popcorn tinPremieres 2026-12-02 - Episode 19 · RONIN BRIDGE 2022
The Ronin bridge heist, start to finish: a phished employee, 5 keys and 6 days unnoticedPremieres 2026-12-06
Identity and access
Logins, two-step verification, and who can reset them.
- SEC 2024
How the SEC's X account was hacked: a fake ID, a SIM swap and no MFAMissing control: No SMS account recovery - COLONIAL PIPELINE 2021
How the Colonial Pipeline hack happened: one unused VPN account and no MFAMissing control: Multifactor authentication on all remote access - TWITTER 2020
How the 2020 Twitter hack happened: a fake help desk call and an admin toolMissing control: Strict limits on internal admin tools - MIRAI 2016
How the Mirai botnet knocked Twitter and Netflix offline with factory passwordsMissing control: Mandatory default password change - RONIN 2022
How the Ronin bridge was hacked: a fake job offer and $600 millionMissing control: Independent custody of signing keys - UBER 2022
How Uber got hacked in 2022: a stolen password and one tired tapMissing control: Phishing-resistant MFA, not push approvals - MGM 2023
How the MGM Resorts cyberattack happened: the help desk call that cost $100 millionMissing control: Verify callers before help desk resets - LASTPASS 2022
How the LastPass breach happened: the engineer's home computerMissing control: Keep critical keys off personal devices - CHANGE HEALTHCARE 2024
How the Change Healthcare breach happened: one password, no second factorMissing control: MFA on every remote portal - 23ANDME 2023
How the 23andMe breach happened: 14,000 logins that exposed 6.9 million peopleMissing control: Mandatory two-step login for all accounts - SNOWFLAKE 2024
How the 2024 Snowflake breaches happened: old stolen passwords and no second lockMissing control: Enforced MFA and credential rotation - OKTA 2023
How the Okta breach happened: a work password saved to a personal Google accountMissing control: Block personal browser profiles at work - RETOOL 2023
How the Retool breach happened: a deepfaked IT call and one synced codeMissing control: Phishing-resistant MFA like hardware keys - LAPTOP FARM 2023
How the Arizona laptop farm worked: North Korean IT workers hired at 309 US companiesMissing control: Verify new hires' identity and location - CISCO WEBEX 2018
The Cisco Webex outage: how an ex-employee wiped 456 servers 5 months after quittingMissing control: Revoke cloud access at offboarding - TWILIO 2022
How the Twilio breach happened, and why Cloudflare shrugged off the same textsMissing control: Phishing-resistant hardware security keys - UKRAINE GRID 2015
How the 2015 Ukraine power grid hack worked: stolen logins, no second factorMissing control: Two-factor login on remote access - VASTAAMO 2020
What happened in the Vastaamo breach: therapy records held for ransom, one patient at a timeMissing control: Access control on sensitive databases - EA 2021
How the EA hack happened: a $10 stolen cookie and a lost-phone storyMissing control: Verify identity before issuing MFA tokens - UBER 2016
How the Uber breach happened: a cloud key left in the code, and a $100,000 cover-upMissing control: No secret keys in code - ICLOUD PHISHING 2014
How the 2014 celebrity iCloud hack happened: fake emails, real passwordsMissing control: Phishing-resistant multi-factor authentication - DMM BITCOIN 2024
How DMM Bitcoin was hacked: a fake recruiter, a vendor and $308 millionMissing control: Device-bound sessions for vendor staff - OPM 2015
How the OPM breach happened: a contractor's login and the two-factor rule nobody enforcedMissing control: Enforced two-factor for remote access - ASTROS HACK 2013
How a Cardinals executive hacked the Astros with an old reused passwordMissing control: Force new unique passwords plus MFA - STORM-0558 2023
The Storm-0558 Microsoft email hack: one old signing key, 22 organizationsMissing control: Rotate and validate login signing keys - MICROSOFT 2024
How Russian spies read Microsoft executives' email: a forgotten test accountMissing control: MFA on every account, even test - AP TWEET 2013
How a hacked AP Twitter account wiped $136 billion off stocks in 3 minutesMissing control: Two-factor login on social accounts - MOTOROLA 1992
How Kevin Mitnick talked his way into Motorola's source codeMissing control: Verify caller identity before sharing - MEDIBANK 2022
How the Medibank hack happened: one synced password and a VPN without MFAMissing control: MFA on remote VPN access - SONY PICTURES 2014
The Sony Pictures hack: wiped computers and a folder named PasswordMissing control: No plaintext password files on shares - ASHLEY MADISON 2015
How the Ashley Madison hack happened: a stolen login and a one-factor VPNMissing control: MFA on remote access - CLOROX 2023
How the Clorox hack happened: attackers who just asked the help deskMissing control: Verify identity before credential resets - SIM SWAP 2018
How a SIM swap stole $23.8 million: the phone number that unlocked everythingMissing control: Non-SMS MFA and carrier port locks - ICLOUD WIPE 2012
How 2 support calls wiped a journalist's iPhone, iPad and MacBookMissing control: Consistent identity checks across support - RSA SECURID 2011
The RSA SecurID hack of 2011: one spreadsheet from the junk folderMissing control: Isolate authentication secrets from corporate network - OLDSMAR 2021
The Oldsmar water 'hack': a poisoning scare that may not have been an attackMissing control: Unique credentials for remote access - CODE SPACES 2014
How the Code Spaces hack happened: one cloud login deleted a company in 12 hoursMissing control: MFA on the cloud admin console - ZOMBIE ALERT 2013
The zombie emergency alert: how default passwords let hoaxers take over TVMissing control: Change default passwords before deployment - BRITISH LIBRARY 2023
How ransomware took down the British Library: one remote server without MFAMissing control: MFA on all third-party remote access - POLY NETWORK 2021
The Poly Network hack: how $610 million was taken, and why it came backMissing control: Separate power to change withdrawal signers - FTX DRAIN 2022
The FTX hack: how a fake ID and a SIM swap drained $400 million on bankruptcy dayMissing control: No SMS codes guarding exchange funds - NORSK HYDRO 2019
How the Norsk Hydro ransomware attack happened, and why the company refused to payMissing control: MFA for admins and disciplined patching
Vendors and third parties
Contractors, IT providers and suppliers with a key to your systems.
- TARGET 2013
How the Target breach happened: a vendor's billing login and the alarms nobody answeredMissing control: Vendor access segmented from payment systems - SOLARWINDS 2020
How the SolarWinds hack happened: malware shipped as a trusted updateMissing control: Integrity checks on the build pipeline - MARRIOTT 2018
What caused the Marriott breach: the intruder that came with StarwoodMissing control: Security due diligence before acquisition - BYBIT 2025
How the Bybit hack happened: a vendor's laptop and a screen that liedMissing control: Independently verify what signers approve - C&M SOFTWARE 2025
The C&M Software hack: a sold login and $140 million from Brazil's bank reservesMissing control: Monitor vendor privileged credential use - CAESARS 2023
How the Caesars hack happened: a con at the outsourced IT help deskMissing control: Help desk identity verification - ATM HEIST 2013
How the $45 million ATM heist worked: prepaid cards with no limitsMissing control: Vendor controls on prepaid card limits - FAKE SECURITY FIRM
Combi Security: the cybercrime gang that ran a fake security companyMissing control: Verify employers and vendors independently - KASEYA 2021
The Kaseya VSA attack: how one IT tool delivered ransomware to 1,500 businessesMissing control: Vendor remote access risk assessment - RIVIERA MAYA 2020
The Riviera Maya ATM gang: when the skimmer came with the machineMissing control: Vet who owns and services ATMs - M&S 2025
The M&S cyber attack: how one impersonation stopped online orders for 46 daysMissing control: Third-party help desk caller verification - IOWA COURTHOUSE 2019
Hired to break in, then jailed for it: the Iowa courthouse pen testMissing control: Written scope approved by all owners
Patching and monitoring
Known holes left open and alarms nobody answered.
- EQUIFAX 2017
What caused the Equifax breach? An unpatched website and an expired certificateMissing control: Timely patching and verified monitoring - CAPITAL ONE 2019
How the Capital One breach happened: one misconfigured cloud firewallMissing control: Continuous review of cloud configurations - KNIGHT CAPITAL 2012
What happened to Knight Capital: $460 million lost in 45 minutesMissing control: Verified, controlled code deployment - WANNACRY 2017
How WannaCry hit the NHS: the fix existed 2 months before the attackMissing control: Patch critical flaws within days - HEARTLAND 2008
How the Heartland breach happened: 130 million cards and an informantMissing control: Encrypt card data in transit internally - IRISH HSE 2021
How the HSE cyber attack happened: one spreadsheet and 8 weeks of ignored alertsMissing control: Act on security alerts promptly - NASA JPL 2018
How a Raspberry Pi let hackers into NASA's Jet Propulsion LaboratoryMissing control: Complete inventory of connected devices - TJX 2007
How the TJX breach happened: 45.7 million cards and a store's weak Wi-FiMissing control: Strong wireless encryption and segmentation - SANDS CASINO 2014
The Las Vegas Sands cyberattack: a forgotten test server and a wiped casino networkMissing control: Lock down forgotten development servers - YAHOO 2014
The Yahoo breach of 2014: 500 million accounts and 2 years of silenceMissing control: Escalate and disclose breaches promptly - MOVEIT 2023
How the MOVEit hack happened: one file-transfer flaw, 60 million peopleMissing control: Purge data from file-transfer servers - DALLAS SIRENS 2017
Why every Dallas tornado siren went off at midnight: a radio signal nobody checkedMissing control: Authenticate commands sent to field devices - JEEP 2015
How the Jeep Cherokee hack worked: from the dashboard radio to the brakesMissing control: Isolate infotainment from vehicle controls - ATLANTA 2018
The 2018 Atlanta ransomware attack: the city that was warned firstMissing control: Remediate prior security audit findings - BERKELEY HACK 1986
How a 75-cent accounting error at Berkeley Lab exposed a hacker selling to the KGBMissing control: Audit and monitor account usage logs - CASINO FISH TANK
How a casino got hacked through its fish tank: the gadget on the networkMissing control: Segment IoT devices from core network - NOMAD BRIDGE 2022
The Nomad bridge hack: how one bad setting let hundreds of strangers drain $190 millionMissing control: Test upgrade defaults before deployment - WORMHOLE 2022
How the Wormhole hack worked: $320 million minted past a skipped checkMissing control: Retire deprecated verification code before launch - MT GOX 2014
What happened at Mt. Gox: the bitcoin that drained out for years before anyone noticedMissing control: Reconcile wallets against the ledger daily - TRAVELEX 2020
How the Travelex ransomware attack happened: 7 warned, unpatched VPN serversMissing control: Patch internet-facing VPNs within days
Payments and fraud
Fake invoices, fake bosses and money that moved without a second check.
- BANGLADESH BANK 2016
How the Bangladesh Bank heist happened: $81 million over SWIFT, stopped short by a typoMissing control: Independent verification of outgoing payment orders - FAKE INVOICES 2013
How Google and Facebook were scammed: the fake supplier invoicesMissing control: Verify payment changes with known supplier - ARUP 2024
The Arup deepfake scam: the $25 million video call where everyone else was fakeMissing control: Verify payment requests out of band - VOICE DEEPFAKE 2019
The first known AI voice scam: how a fake boss's call took $243,000Missing control: Callback verification before urgent payments - BITFINEX 2016
The Bitfinex hack: how 119,754 bitcoin walked out, then sat still for 5 yearsMissing control: Independent second approval on withdrawals - FAKE SUPPORT 2024
How a fake Google support call stole 4,100 bitcoin from one personMissing control: Call back on a known number - PNB 2018
How the Punjab National Bank fraud hid $1.8 billion outside the bank's own booksMissing control: Reconcile SWIFT messages with core banking - SILK ROAD 2012
How 50,000 stolen Silk Road bitcoin ended up in a popcorn tinMissing control: Balance checks on every withdrawal - HUSHPUPPI 2020
How Hushpuppi's fake school loan worked: the Instagram star who laundered scam moneyMissing control: Verify payee identity before sending funds - CITIBANK 1994
The 1994 Citibank hack: how $10 million moved on stolen customer passwordsMissing control: Out-of-band verification of large transfers - FACC 2016
How FACC lost 50 million euros to a fake CEO email, and why the real CEO was firedMissing control: Dual approval for large wires - UNATRAC 2018
How one fake login cost Unatrac $11 million: the Forbes-listed fraudster's email scamMissing control: MFA on executive email accounts - UBIQUITI 2015
How Ubiquiti lost $46.7 million: the wire requests nobody called to checkMissing control: Callback verification for wire requests - ONECOIN 2017
How OneCoin worked: the $4 billion cryptocurrency that never existedMissing control: Verify the asset actually exists
Insider risk
Trusted people with too much access and nobody watching.
- LOTTERY 2010
How the Hot Lotto was rigged: the security director who wrote the numbersMissing control: Segregation of duties - UBIQUITI 2020
The Ubiquiti hack was an inside job: how a senior developer extorted his employerMissing control: Monitor privileged insider access - COINBASE 2025
How the Coinbase data breach happened: bribed support agents and a $20 million demandMissing control: Least-privilege limits on support data - BARINGS 1995
How one trader brought down Barings Bank: account 88888Missing control: Separate trading from trade settlement - TWITTER 2015
How a Twitter employee sold user data to Saudi Arabia for a watch and cashMissing control: Role-based access to user data - TESLA 2020
The Tesla insider bribe plot: the $1 million offer an employee reportedMissing control: Insider bribe reporting channel - KNOWBE4 2024
How a security training company hired a North Korean fake IT workerMissing control: Identity proofing during remote hiring - SOCGEN 2008
How Jerome Kerviel hid 50 billion euros in bets from Societe GeneraleMissing control: Independent confirmation of every trade - CREDIT UNION 2021
Fired on Wednesday, deleting files on Friday: the credit union access that never got cutMissing control: Disable access at termination time - SAN FRANCISCO 2008
How one network engineer locked San Francisco out of its own networkMissing control: No single-person admin control - DISCORD LEAKS 2023
How the Discord leaks happened: the airman who read what he didn't needMissing control: Need-to-know access with monitoring - AT&T UNLOCKS 2017
The AT&T unlocking scheme: bribed call center staff and 1.9 million phonesMissing control: Monitor privileged support staff actions - MAROOCHY 2000
The Maroochy sewage attack: how a rejected job applicant flooded parks with wasteMissing control: Cut ex-contractor access; authenticate commands - FORMER EMPLOYEE 2016
How a former employee read his old firm's files for 2 yearsMissing control: Rotate shared credentials at offboarding - QUADRIGA 2018
What really happened at QuadrigaCX: the cold wallets that were already emptyMissing control: Independent audits of client asset custody - WAYMO SECRETS 2016
The Levandowski case: how Google's self-driving secrets walked out on a laptopMissing control: Monitor downloads by departing staff - LEDGER 2023
How the Ledger Connect Kit was poisoned: a former employee's account nobody closedMissing control: Revoke every external account at offboarding
Backups and recovery
What decides whether an attack is a bad week or the end of the business.