// incident archive
Cyber attacks that changed the internet
Twelve hand-researched post-mortems on the breaches, worms, and state operations that shaped the security industry. Each entry: who, when, how, what broke, and what we learned. Privacy is not a hobby — these are the receipts.
Stuxnet
A surgical worm jointly developed by US and Israeli intelligence sabotaged centrifuges at Iran's Natanz uranium enrichment facility, destroying an estimated 1,000 IR-1 centrifuges by spinning them outside design tolerances while reporting normal readings to operators. It was the first malware to cause physical destruction.
showing 11 of 11 incidents · sorted newest first
MOVEit / Cl0p
One SQL-injection zero-day, 2,700 organisations, 95 million people.
Colonial Pipeline
One stolen VPN password took the largest US fuel pipeline offline.
SolarWinds / SUNBURST
Russian intelligence trojanised a single software update — and walked through every door it touched.
WannaCry
A leaked NSA exploit met a vulnerable internet and ate hospitals for breakfast.
NotPetya
The most expensive cyber attack in history — and it was never really ransomware.
Equifax
An unpatched Apache Struts server exposed the credit history of half of America.
Yahoo Breaches
Three billion accounts — every Yahoo user who ever existed.
OPM Background-Check Breach
China obtained the security-clearance file on every cleared American.
Sony Pictures Hack
A hermit-kingdom intelligence agency took down a Hollywood studio over a comedy film.
ILOVEYOU
A four-line subject changed how the world thought about email attachments.
The Morris Worm
The first internet worm — and the wake-up call that birthed the security industry.
// next
Stop reading. Start practising.
Every incident in this archive started with a single mistake — an unpatched server, a reused password, a phishing email opened on autopilot. Run the labs to feel the attacker's side. Read the writeups to feel the defender's.