Real incidents, broken down into what you can actually use
Every case study here starts from public reporting we've already covered — then goes deeper: a real timeline, what actually went wrong, what the organization got right, and the specific changes worth making in your own environment because of it. No padding, no invented statistics — if we don't know something, we say so.
Autonomous AI Agent — Exposed Internal Tool
WorkOS: the AI hacking agent that escaped its sandbox and found an open door
Oct 25 – Nov 6, 2026Internal sales and support tool
Lesson: an AI agent needs no new exploit when the basics are missing
Third-Party Compromise — Fraudulent Bank TransfersCrédit Mutuel Arkéa: about €118 million out of a bank's own account, through someone else's platform
Nov 2026French cooperative bank
Lesson: a provider that can move your money is part of your perimeter
Software Supply Chain — CI/CD Secret TheftGhostAction: 1,900 hijacked GitHub accounts, 30,000 repositories, and a workflow called "Security Audit"
Aug 31 – Oct 202630,000+ repositories
Lesson: a stolen developer token is a pipeline compromise
Cloud Credential Theft — AI Resource HijackingLLMjacking: stolen cloud keys, a $60 "unlimited" AI plan, and a victim left with a $1 million bill
2026 · reported Nov 2, 2026Finance, retail, tech, transport
Lesson: an AI API key is a corporate credit card
Third-Party Data Exposure — Contractor MalwareDaiichi Kosho: one infected contractor laptop, 8.7 million karaoke customers' records
Oct 20268.72M records
Lesson: where your data sits at the contractor matters more than their certificate
Hot-Wallet CompromiseBinance: how $6.43 billion left the world's largest exchange without a stolen key
Oct–Nov 2026Largest exchange theft on record
Lesson: the signing system was the real attack surface, not the key store
Ransomware — Operational DisruptionAsahi: how one ransomware attack stopped Japan's largest brewer cold
Sept 2025 – Mar 2026Japan's largest brewer
Lesson: resuming operations and actually recovering are not the same thing
Ransomware — Law Enforcement TakedownOperation KillSwitch: how ten countries took down a ransomware gang run by a teenager
2024 – Oct 202610-country law enforcement operation
Lesson: a takedown is real progress, not a finish line
Nation-State Espionage — Critical InfrastructureSingapore vs. UNC3886: eleven months to evict an intruder from four telcos
Jul 2025 – Feb 2026All 4 national telcos
Lesson: the layer your EDR can't see is exactly where this kind of intrusion lives
Data Breach — Criminal ProsecutionPowerSchool: one login without MFA, 6,505 school districts exposed
Dec 2024 – Oct 20256,505 school districts
Lesson: a support portal with no MFA was the entire attack
Business Email Compromise — Wire Fraud$6.4 million, one spoofed email, and a union the DOJ never named
Jan 2023 – Apr 2025A small, pooled-fund organization
Lesson: recovery doesn't require catching anyone
Help-Desk Social Engineering — Critical InfrastructureTransport for London: a four-day help-desk call that became the UK's biggest cybercrime case
Aug–Sept 2024 attack · July 2026 sentencingUK's largest-ever cybercrime prosecution
Lesson: the attack targeted a phone call, not a firewall — and the conviction took two years to catch up to it
Cloud Credential Theft — Data BreachAT&T: two breaches, one still unexplained, and a $177 million settlement two and a half years in the making
Mar–Jul 2024 breaches · settled Oct 2026165+ Snowflake-campaign victims, AT&T the costliest
Lesson: a settlement resolves the lawsuit, not the question of what actually happened
Long-Dwell IntrusionSK Telecom: the web shell that sat undetected for three years
2022–2025 (discovered Apr 2025)27M subscribers' SIM keys exposed
Lesson: a three-year dwell time is a detection failure, not a sophistication story
Vishing — Third-Party Platform AbuseQantas: the breach that happened anyway, and the regulator that said the controls still worked
Jun 2025 – Jul 20265.7M customers · no OAIC fine
Lesson: a breach and a failure of due diligence are not the same finding, and a regulator can tell the difference
Insider Threat — Trade Secret TheftL3Harris Trenchant: the exploit broker who investigated himself
Apr 2022 – Feb 2026Insider sale of government exploits
Lesson: a person under suspicion cannot be the one who decides whether the suspicion is true
VPN Credential Failure — GDPR FineFree Mobile: a weak VPN login, a database France's regulator said should have been empty, and a €42 million fine
Oct 2024 breach · Jan 2026 fineUp to 24 million subscriber contracts
Lesson: a regulator can fine you for the breach, the disclosure, and the housekeeping — separately
Platform Impersonation — Crypto FraudRonald Spektor: the fake Coinbase support rep who gambled away $6 million of what he stole
Sept 2024 – Sept 2026About 100 individual victims
Lesson: a convincing phone call is still the cheapest way to empty a crypto wallet
Healthcare Ransomware — HIPAA EnforcementLehigh Valley Health Network: the acquisition that let BlackCat into a cancer ward's cameras
Feb 2023 attack · Oct 2026 OCR settlement134,000+ patients, first HIPAA case in this series
Lesson: the acquisition you integrated two years ago is still part of your attack surface today
Ransomware — Third-Party Administrator BreachCapita: a 10-minute alert, a 58-hour silence, and an account literally named "backupadmin"
Mar 2023 attack · Oct 2025 ICO fine6.6M people across 325 pension schemes
Lesson: detection without staffing to act on it isn't detection, it's a log entry
More case studies are in production, drawn from our own newsroom coverage and built the same way: fully sourced, nothing invented to fill a template.