Cyber Security Incident Scenarios

Unusual website behaviour, missing form submissions and user redirections raised concerns about a possible compromise.

Identified malicious code injected via an outdated plugin, with traffic redirection and form data harvesting.

Isolate and clean environment, patch vulnerabilities, review access logs, implement monitoring.

Surge in unauthorised account access, failed logins and increased refund requests indicated automated abuse.

Evidence of credential stuffing using previously leaked email-password combinations from external sources.

Implement rate limiting and behaviour detection, secure affected accounts, enforce password resets, enhance monitoring.

Invoice payments were paid to incorrect bank accounts after a senior employee's email account was compromised.

Analysis showed a phishing email led to account access, followed by monitoring and manipulation of email conversations.

Secure affected accounts, enforce stronger authentication, review access logs and implement email security controls.

A customer reported accessing data belonging to another tenant, indicating a possible API misconfiguration.

Review API configuration, access controls and logs to identify and reproduce the issue.

Correct configuration, review redundant permissions, implement monitoring and detect abnormal API usage.

Employees were locked out of systems and ransom notes were discovered on several machines.

Confirmed ransomware deployment had started but was not fully executed.

Isolate affected systems, block spread, remove malicious components, restore systems from backups safely and strengthen security controls.