CyberCasebook

I make cybercrime documentaries — hacker takedowns, data breaches, scams. New case every week. Small channel, 90 subs, growing it the honest way. Subscribe if that's your thing.

A hacker shut down America's biggest fuel pipeline with one stolen password. No zero-day, no fancy exploit. Colonial paid $4.4 million and gas stations ran dry across the East Coast. The scariest breaches start with the most boring mistakes.

South Korea's largest brokerage got hacked this week. 3,800 customer account numbers and 35,255 staff records, passwords included. The way in was its phone-login service. Your broker holds your money and your identity. #CyberSecurity

A disaster-alert service used by 875 Japanese public bodies got hijacked and sent 1.42 million phishing emails. The system built to warn people became the attack. Trust in the sender is the whole scam. #CyberSecurity

Most people check if their password leaked. Almost nobody checks whether their email is silently forwarding to someone else. One inbox rule can send every password reset to a stranger. Check your forwarding rules tonight.

A hospital paid the ransom, got a decryptor, and still lost patient records because the attackers had encrypted the backups first. A ransom payment buys a maybe, not your data back.

Most people check if a password was leaked. Almost nobody checks if their old phone number is still tied to an account they forgot. That number is often the reset button for everything else.

Most breach advice assumes you will get an email telling you. Detection still takes weeks, not minutes, so by the time the alert arrives the data has already been copied, sold and resold. The weak link is not the password. It is noticing.

A data broker breach is different from a normal breach. You never signed up, never made an account, never agreed to anything, yet your address, phone and relatives are in the dump. You cannot change a password you never set.

People treat a password manager like overkill until the day their reused password shows up in a breach dump. One leaked forum login from 2019 can still open accounts in 2026. Boring tool, but it closes the cheapest door attackers have.

Every breach email that says click here to reset your password trains people to do exactly what phishing asks them to do. Then companies act surprised when the fake one works. Stop putting the link in the email. Tell people to go to the site themselves.

Most ransomware crews do not break in through a zero day. They walk in through a VPN login bought for a few dollars, or a helpdesk reset that skipped the hard questions. The expensive firewall never gets tested. The cheap identity check does.

A single leaked session cookie can skip your password and your second factor entirely. That is why so many takeovers look clean in the logs: no failed login, no alert, just a session that was already trusted. Revoking sessions should be as easy as changing a password.

That QR code on the parking meter is not a shortcut, it is a phishing page with a camera. Quishing reports jumped as scammers stick their own codes over real ones, and your phone will not warn you before it opens the fake payment page. Type the address yourself.

That forum account you made in 2014 still exists, probably with the same password you use today. Dead accounts are how credential stuffing starts: one old breach, one reused password, and someone is already inside your inbox.

Your router still runs the password printed on its sticker. That sticker is in millions of photos, manuals, and default lists online. Change the admin password, turn off remote admin, and update the firmware. The boring box in the corner is the front door.

Your phone number is the weakest password you own. A SIM swap doesn't break any encryption. It just convinces a carrier employee to move your number to an attacker's SIM, and every SMS code you rely on follows it.

Richmond Public Schools got 72 hours to 'open talks' after ransom notes hit staff laptops. Schools are perfect targets: thin IT budgets, soft deadlines, and data no district can afford to leak. The attackers know the playbook. The districts never get to read it.

The most dangerous cybercriminals aren't in hoodies in dark rooms. They're in suits, selling the tools. Ransomware-as-a-service turned hacking into a subscription business with customer support. The operator isn't the story. The business model is.