Real incidents and what they teach
Real incidents and what they teach
Neutral, sourced summaries of public incidents and statistics, and the exposures behind them.
How to read these
- These are public incidents, not customers.
- Figures are as reported by the cited source, and every page links to its sources.
- Each page says what PixelPrivate can check and what it cannot do. We do not detect intrusions or fraud.
Last reviewed 2026-10-06.
- Statistic
Business email compromise losses, per the FBI IC3 2025 report
BEC adjusted losses of $3,046,598,558 were reported in 2025.
Read the summary - Incident
Exposed .env files and a large-scale cloud extortion campaign
A campaign scanned 230 million+ unique targets for exposed environment files.
Read the summary - Incident
An expired certificate and the Ericsson, O2 and SoftBank outages
Ericsson said expired software certificates caused the outage.
Read the summary - Incident
Dangling DNS records and the SubdoMailing campaign
Guardio Labs reported 8,000+ hijacked domains in the SubdoMailing campaign.
Read the summary - Incident
Lookalike domains used in fraud: Microsoft DCU action, July 2021
Microsoft took control of 17 homoglyph domains used in BEC.
Read the summary - Incident
Colonial Pipeline 2021: a legacy VPN account without multi-factor authentication
The entry point was a legacy VPN account with single-factor authentication.
Read the summary - Incident
Inbox rules and forwarding in a large BEC infrastructure
Rules forwarded mail containing "invoice", "payment" or "statement" to attacker addresses.
Read the summary - Advisory
MFA fatigue and legacy authentication
Microsoft analysis: more than 99 percent of password spray attacks use legacy authentication protocols.
Read the summary - Statistic
Small business and ransomware in the Verizon DBIR
The 2025 DBIR reports ransomware in 88% of SMB breaches versus 39% across all organizations.
Read the summary
Looking for illustrations of how this could apply to you? See the hypothetical scenarios.
See what the internet sees of your business
Enter your domain for a free passive check.
No credit card · Cancel anytime · Reverts to the Free plan automatically