📚 Real-World Cyber Incidents

Learn from major security breaches and understand how attacks unfold, their impact, and lessons learned.

7
Major Incidents
$2.5B+
Total Financial Impact
500M+
Records Compromised
6 Units
Course Coverage
May 2017

WannaCry Ransomware Attack

Global ransomware pandemic affecting 150+ countries

Ransomware Healthcare EternalBlue Exploit
▼

📋 Overview

WannaCry was a worldwide cyberattack that targeted computers running Microsoft Windows by encrypting data and demanding ransom payments in Bitcoin. The attack exploited a vulnerability in Windows SMB protocol using the EternalBlue exploit, allegedly developed by the NSA and leaked by the Shadow Brokers hacking group.

🎯 Attack Vector

  • Entry Point: EternalBlue exploit targeting SMBv1 vulnerability (MS17-010)
  • Propagation: Self-replicating worm capability spreading across networks
  • Payload: Encryption of user files with RSA-2048 and AES-128 algorithms
  • Ransom Demand: $300-$600 in Bitcoin per infected machine

💥 Impact Assessment

Organizations Affected
200,000+
Countries Impacted
150+
Financial Damage
$4 Billion
NHS Downtime
5 Days

⏰ Attack Timeline

May 12, 08:00 UTC
Initial infections detected in Europe
May 12, 12:00 UTC
NHS declares major incident, cancels appointments
May 12, 15:00 UTC
Kill switch domain registered by Marcus Hutchins
May 13
Variants without kill switch emerge
May 15
Microsoft releases patches for unsupported Windows versions

💡 Lessons Learned

✓
Patch Management: Organizations must apply security patches promptly. MS17-010 was released 2 months before the attack.
✓
Network Segmentation: Worm propagation was enabled by flat network architectures without proper segmentation.
✓
Backup Strategy: Organizations with offline backups recovered faster than those without.
✓
Legacy Systems: Many infections occurred on Windows XP systems no longer receiving updates.

📖 Related Course Content

Unit 1 - Introduction Unit 2 - Threat Intelligence Unit 4 - Incident Response

Answer Related Questions

This case study relates to multiple workbook questions about malware, incident response, and impact assessment.

View Related Questions →
September 2017

Equifax Data Breach

One of the largest data breaches in history

Data Breach Finance Unpatched Vulnerability
▼

📋 Overview

Equifax, one of the three largest credit reporting agencies, suffered a massive data breach that exposed sensitive personal information of 147 million people. The breach was caused by an unpatched vulnerability in Apache Struts, a web application framework, despite a patch being available for months.

🎯 Attack Vector

  • Vulnerability: CVE-2017-5638 in Apache Struts 2 framework
  • Exploitation: Remote code execution through crafted HTTP requests
  • Access Period: Attackers had access for 76 days undetected
  • Data Exfiltration: Encrypted traffic to hide data theft

💥 Impact Assessment

People Affected
147 Million
Settlement Amount
$700 Million
Stock Value Loss
35%
Breach Duration
76 Days

💡 Lessons Learned

✓
Vulnerability Management: Critical patches must be applied immediately. Apache Struts patch was available 2 months before exploitation.
✓
Network Monitoring: 76 days of undetected access highlights need for better intrusion detection systems.
✓
Data Encryption: Sensitive PII should be encrypted at rest, not just in transit.
✓
Incident Response: Delayed public disclosure (6 weeks) damaged trust and violated regulations.

📖 Related Course Content

Unit 1 - Introduction Unit 2 - Threat Intelligence Unit 3 - Testing Unit 4 - Incident Response Unit 5 - Standards & Ethics

Answer Related Questions

Use this case study for questions about vulnerabilities, incident response, and ethical responsibilities.

View Related Questions →
May 2021

Colonial Pipeline Ransomware Attack

Critical infrastructure shutdown affecting fuel supply

Ransomware Infrastructure DarkSide
▼

📋 Overview

Colonial Pipeline, which supplies 45% of fuel consumed on the US East Coast, was forced to halt operations after a ransomware attack by the DarkSide cybercrime group. The company paid $4.4 million in ransom to restore operations, though $2.3 million was later recovered by the FBI.

🎯 Attack Vector

  • Initial Access: Compromised VPN account using stolen credentials
  • No MFA: VPN account lacked multi-factor authentication
  • Lateral Movement: Attackers moved through corporate network to IT systems
  • Ransomware: DarkSide ransomware deployed across network

💥 Impact Assessment

Ransom Paid
$4.4 Million
Shutdown Duration
6 Days
Pipeline Coverage
5,500 Miles
Daily Capacity
2.5M Barrels

💡 Lessons Learned

✓
Multi-Factor Authentication: MFA on all remote access points is critical. The compromised VPN had no MFA enabled.
✓
Network Segmentation: Proper segmentation between IT and OT systems could have prevented operational shutdown.
✓
Critical Infrastructure: Attacks on infrastructure have national security implications requiring rapid government response.
✓
Incident Response Planning: Pre-established playbooks enable faster decision-making during crises.

📖 Related Course Content

Unit 2 - Threat Intelligence Unit 3 - Testing Unit 4 - Incident Response Unit 5 - Standards & Ethics

Answer Related Questions

Excellent case study for incident response, critical infrastructure, and ransomware questions.

View Related Questions →
December 2020

SolarWinds Supply Chain Attack

Sophisticated nation-state attack via software updates

Supply Chain APT Nation-State
▼

📋 Overview

The SolarWinds Orion platform compromise was one of the most sophisticated cyberattacks ever discovered. Attackers, believed to be Russian state-sponsored group APT29 (Cozy Bear), inserted malicious code into legitimate software updates, compromising approximately 18,000 organizations including US government agencies and Fortune 500 companies.

🎯 Attack Vector

  • Supply Chain Compromise: Malware injected into SolarWinds Orion build process
  • Sunburst Backdoor: Trojanized DLL file in legitimate software updates
  • Stealth Tactics: Dormancy periods, domain generation algorithms, legitimate-looking traffic
  • Lateral Movement: SAML token forgery to access cloud resources

💥 Impact Assessment

Organizations Hit
18,000+
Active Intrusions
100+
Gov Agencies
9 US Depts
Undetected Period
9 Months

⏰ Attack Timeline

Sep 2019
Initial compromise of SolarWinds network
Mar 2020
Malicious code inserted into Orion updates
May 2020
Trojanized updates distributed to customers
Dec 13, 2020
FireEye discovers breach, alerts authorities
Dec 17, 2020
Microsoft, CISA issue emergency directives

💡 Lessons Learned

✓
Supply Chain Security: Third-party software requires rigorous security vetting and monitoring.
✓
Build Environment Security: Code signing and build pipeline integrity are critical attack surfaces.
✓
Zero Trust Architecture: Assume breach mentality with continuous verification and least privilege access.
✓
Detection Capabilities: Advanced persistent threats require sophisticated detection beyond traditional signature-based tools.

📖 Related Course Content

Unit 1 - Introduction Unit 2 - Threat Intelligence Unit 3 - Testing Unit 4 - Incident Response

Answer Related Questions

Perfect for APT analysis, supply chain security, and advanced threat detection questions.

View Related Questions →
December 2013

Target Data Breach

Point-of-sale compromise via HVAC vendor

Retail POS Malware Third-Party Risk
▼

📋 Overview

Target suffered a massive data breach during the holiday shopping season when attackers gained access through a third-party HVAC vendor's credentials. The breach compromised 40 million credit and debit card accounts and 70 million customer records, making it one of the largest retail breaches in history.

🎯 Attack Vector

  • Initial Access: Phishing email to HVAC vendor (Fazio Mechanical)
  • Vendor Compromise: Stolen credentials for Target's vendor portal
  • Network Pivot: Lateral movement from vendor network to POS systems
  • Malware: Custom POS RAM scraping malware (BlackPOS)

💥 Impact Assessment

Card Accounts
40 Million
Customer Records
70 Million
Settlement Cost
$292 Million
CEO Resigned
Yes

💡 Lessons Learned

✓
Third-Party Risk: Vendor access must be strictly controlled with proper network segmentation.
✓
Alert Fatigue: Security tools detected the breach but alerts were ignored due to high false positive rates.
✓
PCI DSS Compliance: Compliance doesn't equal security; additional controls beyond standards are necessary.
✓
Network Segmentation: HVAC vendor should not have had access to payment systems.

📖 Related Course Content

Unit 1 - Introduction Unit 2 - Threat Intelligence Unit 3 - Testing Unit 5 - Standards & Ethics

Answer Related Questions

Great example for third-party risk, network segmentation, and compliance questions.

View Related Questions →
June 2027

NotPetya Cyberattack

Destructive wiper disguised as ransomware

Wiper Malware Nation-State Ukraine
▼

📋 Overview

NotPetya was a devastating cyberattack initially targeting Ukraine but spreading globally, causing over $10 billion in damages. Unlike ransomware, it was a destructive wiper designed to permanently destroy data. It spread through a compromised update to Ukrainian accounting software M.E.Doc and used EternalBlue and Mimikatz for propagation.

🎯 Attack Vector

  • Initial Vector: Trojanized update to M.E.Doc accounting software
  • Propagation: EternalBlue exploit, PSExec, and WMI for spreading
  • Credential Theft: Mimikatz to extract credentials from memory
  • Destruction: MBR overwrite making systems unrecoverable

💥 Impact Assessment

Total Damages
$10 Billion
Maersk Loss
$300 Million
Countries Hit
65+
Intent
Destruction

💡 Lessons Learned

✓
Software Update Security: Automatic updates can be weaponized; verify authenticity and integrity.
✓
Air-Gapped Backups: Only offline backups survived; cloud and network backups were also encrypted.
✓
Geopolitical Cyber Risk: Cyber warfare can have massive collateral damage beyond intended targets.
✓
Business Continuity: Maersk's recovery took 10 days and cost $300M despite good preparation.

📖 Related Course Content

Unit 1 - Introduction Unit 2 - Threat Intelligence Unit 4 - Incident Response

Answer Related Questions

Excellent for malware analysis, nation-state threats, and disaster recovery planning.

View Related Questions →
November 2018

Marriott International Data Breach

Long-term breach compromising guest records

Data Breach APT Hospitality
▼

📋 Overview

Marriott International discovered unauthorized access to the Starwood guest reservation database that had persisted since 2014 - four years before discovery. The breach compromised personal information of up to 500 million guests, including passport numbers, making it one of the largest hospitality breaches ever.

🎯 Attack Vector

  • Initial Compromise: Starwood systems breached in 2014, before Marriott acquisition
  • Persistence: Attackers maintained access through merger and integration
  • Data Exfiltration: Guest records including passport numbers and payment cards
  • Attribution: Likely nation-state actor (China-linked APT)

💥 Impact Assessment

Guests Affected
500 Million
GDPR Fine
£99 Million
Breach Duration
4 Years
Passport Numbers
5 Million

💡 Lessons Learned

✓
M&A Due Diligence: Cybersecurity assessment must be part of merger and acquisition process.
✓
Legacy System Risk: Inherited systems may have unknown compromises requiring thorough audits.
✓
Data Minimization: Storing passport numbers created unnecessary risk and regulatory liability.
✓
GDPR Implications: One of the first major GDPR fines demonstrating real regulatory consequences.

📖 Related Course Content

Unit 2 - Threat Intelligence Unit 4 - Incident Response Unit 5 - Standards & Ethics

Answer Related Questions

Use for GDPR, data protection, and long-term breach detection questions.

View Related Questions →