An inventory of successful hacks: what if it was not that complicated?

When a big attack hits the headlines, it is tempting to picture a team of geniuses, months of preparation, a flaw nobody had spotted. That happens. But read the official reports published afterwards and you mostly find silly things: a password, a missed update, a box plugged into the Internet that nobody remembered.

There is a simple reason. Most attackers want money, and fast. They do not always pick their victim; they sweep the Internet for open doors, and the Internet is full of them. Why spend three weeks on a well-defended target when the company next door protects its remote access with a plain password?

The numbers back this up. In Verizon’s 2025 Data Breach Investigations Report, stolen credentials are the top way in (22% of cases), just ahead of exploiting known vulnerabilities (20%).

The point of this article fits in one sentence: do not be the easiest target. Here are five real attacks to make the case. I only kept official or first-hand sources: parliamentary hearings, investigation reports, regulator decisions.

1. Colonial Pipeline, 2021: an old VPN account

Colonial Pipeline carries fuel to the US East Coast. On 7 May 2021, ransomware hit its IT and the company shut the pipeline down.

The way in was described by the CEO himself before the US Senate: a legacy VPN profile “that was not intended to be in use”, protected by a single factor. The password was complicated, he insisted. It made no difference. At the time of the hearing, investigators still did not know how the attackers got it.

What it cost: a $4.4 million ransom, paid. The FBI recovered a little over $2.3 million of it. And fuel shortages along the East Coast, recalled by the committee chair when opening the hearing.

What would have been enough: remove accounts nobody uses, and require MFA on remote access.

Sources: official Senate hearing transcript, US Department of Justice release.

2. Equifax, 2017: an update that never happened

Equifax is one of the major US credit reporting agencies. In early March 2017, a flaw in Apache Struts, a widely used web component, was made public. The fix was available.

Two days later, unknown actors scanned Equifax’s servers and found the consumer dispute portal, still vulnerable. The report by the GAO, the US Congress’s audit office, details what followed. The internal alert went to an out-of-date mailing list, so the people in charge of patching never received it. The scan run a week later found nothing. And an expired certificate left the monitoring tool blind, which let the attackers take data out without raising an alarm.

What it cost: data on roughly 147 million people. A settlement with the FTC, the CFPB and US states of at least $575 million, up to $700 million.

What would have been enough: knowing exactly what runs on your exposed servers, and a patching process that does not rely on a mailing list.

Sources: GAO report (2018), FTC press release.

3. Change Healthcare, 2024: a portal without MFA

Change Healthcare, a UnitedHealth subsidiary, moves claims and payments between care providers and insurers in the United States. On 12 February 2024, criminals logged into a Citrix remote access portal with stolen credentials.

UnitedHealth’s CEO put it bluntly in his written testimony to Congress: “The portal did not have multi-factor authentication.” Once inside, the attackers moved through the network, stole data, and launched the ransomware nine days later.

What it cost: UnitedHealth had to advance more than a billion dollars in payments to keep providers afloat during the outage. In its 2024 results, the group puts the business disruption at $867 million for the affected division alone, not counting incident response costs, reported separately.

What would have been enough: MFA on that portal. A checkbox, almost.

Sources: UnitedHealth CEO’s written testimony, UnitedHealth 2024 annual results.

4. France Travail, 2024: hijacked advisor accounts

Back to France. In March 2024, France Travail, the French public employment service, and its partner network Cap emploi reported an intrusion to the CNIL, the French data protection authority. The attackers took over Cap emploi advisor accounts through social engineering, manipulating people rather than machines. With those accounts, they browsed job seekers’ files.

The CNIL found three failings. Advisor authentication was not robust enough. Logging could not flag abnormal behaviour. And permissions were too broad: an advisor could open files of people they did not follow, which multiplied the data within reach. The most frustrating part? Most of these measures had been identified in impact assessments. They simply had not been implemented.

What it cost: up to 43 million people potentially affected according to the CNIL in March 2024 (names, social security numbers, addresses, phone numbers). A €5 million fine in January 2026.

What would have been enough: stronger authentication, and permissions limited to what each advisor needed.

Sources: CNIL, March 2024, CNIL sanction decision, January 2026 (both in French).

5. Supermarket fridges, France, 2026

The most recent example, and probably the most telling. On 12 October 2026, CERT-FR, the French national agency’s alert team, reported “numerous compromises” of remote controllers for refrigeration systems (Danfoss, Copeland, Dixell). The press reported cold rooms and display cases going haywire in supermarkets.

The exact way in has not been published. CERT-FR’s instructions say a lot, though: take every unit with a public IP address off the Internet, update the firmware, switch to strict security mode, change default passwords. The alert also points out that exposing a management interface on the Internet goes against good practice, and that an end-of-life device left exposed without fixes has a “very high probability of compromise”.

What it cost: no official figure yet. I will update this article when there is one.

What would have been enough: keep these interfaces off the Internet, or only behind a VPN, with up-to-date firmware and changed passwords.

Sources: CERT-FR alert CERTFR-2026-ALE-012 (in French), CSO Online.

What these five attacks have in common

None of them starts with an unknown flaw. A forgotten account. A fix not installed. Missing MFA, overly broad permissions, a box that had no business being on the Internet. An honest inventory would have surfaced every one of them.

And it is not just big companies. In France, the national cybersecurity agency (ANSSI) learned of 144 ransomware attacks in 2024, and 37% of known victims were small and mid-sized businesses (2024 threat overview, in French). Verizon finds ransomware in 88% of breaches hitting small and medium businesses, with a median ransom of $115,000. For a small company, that amount alone can be the end.

The minimum, in practice

No multinational budget needed to close the doors above:

1. MFA on everything reachable from outside: email, VPN, remote desktop, admin tools.
2. An inventory of what you expose on the Internet, reviewed regularly. You cannot protect what you forgot.
3. Security updates applied quickly on those exposed systems, with one named person responsible.
4. Unused accounts removed, starting with former employees and contractors.
5. Permissions limited to what each person needs to do their job.
6. No default passwords, anywhere. Yes, even on the fridge controller.

To wrap up

None of this makes a company impregnable. A determined attacker with time and resources may still get in. Most of them are in a hurry, though, and will move on to the next target. Doing the minimum takes you off the list of easy targets, and that already cuts the probability of a successful attack a lot. Never to zero, I would rather be honest about that.

The hardest part is usually knowing where your open doors are. That is exactly what an outside view brings. The External Discovery Audit maps in one day what your company exposes on the Internet. And if you would rather have help putting these basics in place, start with a consultation.