Research &amp; Intelligence Guides

The JLR Cyber Attack: How a Single Breach Contracted UK GDP

Inside the Jaguar Land Rover cyber incident that shut down production for five weeks, cost GBP 1.9 billion, and triggered the UK's first cyber-related government loan guarantee.

11 min read

The Ivanti VPN Zero-Day: How a Buffer Overflow in a VPN Appliance Breached the UK's Domain Registry

In December 2024, a suspected Chinese state-sponsored group exploited CVE-2025-0282, a critical stack-based buffer overflow in Ivanti Connect Secure, to breach Nominet, the registry responsible for over 11 million .uk domain names. The vulnerability required no authentication. Five days after the patch was released, only 120 of 33,542 exposed appliances had been updated.

MuddyWater: How Iran's Intelligence Service Keeps Rebuilding Its Attack Infrastructure

The evolution of MuddyWater's command and control frameworks from Python to Go, how MOIS-linked operators target telecoms and government, and what each framework change reveals about detection pressure.

The TfL Cyberattack: How Scattered Spider Stole 7 Million Customer Records Without Disrupting a Single Train

In September 2024, a cyberattack on Transport for London exposed the data of up to 10 million people, cost over GBP 30 million to remediate, and forced 30,000 staff through in-person password resets. Every train kept running.

The CrowdStrike Outage: What Actually Happened Inside 8.5 Million Machines

A technical breakdown of the July 2024 CrowdStrike outage. How a configuration file triggered a kernel-level crash, why recovery took 10 days, and what your business should learn from it.

10 min read

The Synnovis Ransomware Attack: How One Pathology Provider Took Down Six NHS Trusts

On 3 June 2024, Qilin ransomware hit Synnovis, a private pathology provider. Within hours, blood testing collapsed across south-east London. 10,152 appointments postponed, one patient death confirmed, and a national blood shortage declared.

The Snowflake Customer Breaches: How Stolen Passwords From 2020 Gave Two Hackers Access to 165 Organisations

In May 2024, a financially motivated threat group called UNC5537 used credentials stolen by infostealer malware to access Snowflake customer instances belonging to 165 organisations. Snowflake itself was not breached. Every compromised account lacked multi-factor authentication. The campaign led to data theft affecting hundreds of millions of individuals, including nearly all AT&T wireless customers.

The MOD Payroll Breach: How a Government Contractor Exposed 272,000 Military Personnel Records

In May 2024, a breach of the UK Armed Forces payroll system exposed names, bank details, and home addresses of up to 272,000 serving personnel, reservists, and veterans. The system was operated by third-party contractor SSCL, a subsidiary of French IT firm Sopra Steria. The contractor discovered the breach approximately three months before notifying the government.

The Change Healthcare Attack: How Stolen Credentials and a Missing MFA Config Exposed 190 Million Patient Records

In February 2024, the ALPHV/BlackCat ransomware group used stolen credentials to access a Change Healthcare Citrix portal that lacked multi-factor authentication. Nine days of lateral movement led to ransomware deployment, a USD 22 million ransom payment, and the largest healthcare data breach in US history, affecting approximately 190 million individuals.

11 min read

Southern Water and Black Basta: How 750 GB of Personal Data Left a UK Utility

Black Basta stole 750 GB from Southern Water in January 2024, including National Insurance numbers and passport scans. Here is what happened, what it cost, and what would have reduced the damage.

The County Mayo Water Hack: How a Default Password Took 180 Homes Offline

In December 2023, an IRGC-affiliated group called CyberAv3ngers compromised a Unitronics PLC controlling a water supply in rural Ireland. The default password was 1111. 180 homes lost water for two days.

The MOVEit Breach: How SQL Injection Gave Cl0p Access to 2,773 Organisations Without Deploying Ransomware

In May 2023, the Cl0p ransomware group exploited a SQL injection vulnerability in Progress Software's MOVEit Transfer to steal data from 2,773 organisations affecting 95.8 million individuals. No ransomware was deployed. No files were encrypted. The entire operation was pure data theft and extortion.

The 3CX Supply Chain Attack: How North Korea Turned One Employee's Download Into 600,000 Compromised Installations

In March 2023, the Lazarus Group compromised the 3CX desktop application through a cascading supply chain attack that began with a trojanised trading platform downloaded by a single employee. This was the first documented case of one supply chain attack triggering another.

The Okta Breach: How Teenagers With Commodity Tools Compromised an Identity Provider Serving Thousands

In January 2022, the Lapsus$ group compromised a third-party support contractor to access Okta's internal systems. The breach exposed the architectural risk of centralised identity providers and the supply chain trust problem that most organisations still haven't solved.

Log4Shell: The Logging Library That Could Execute Arbitrary Code

How a feature in Apache Log4j became CVE-2021-44228, scored CVSS 10.0, and exposed the fact that most organisations had no idea what software they were running.

The Kaseya VSA Attack: How REvil Turned One Vulnerability into 1,500 Ransomware Infections

A technical breakdown of the July 2021 Kaseya VSA supply chain attack. How REvil exploited an authentication bypass in managed service provider software to deploy ransomware to 1,500 businesses simultaneously, and why the FBI sat on the decryption key for 19 days.

The HSE Ireland Ransomware Attack: Eight Weeks of Missed Signals

How Conti ransomware encrypted 80% of Ireland's health service IT estate after eight weeks of undetected lateral movement, and what the PwC post-incident review found.

The Colonial Pipeline Attack: How a Single VPN Password Shut Down 5,500 Miles of Fuel Supply

In May 2021, a compromised VPN credential with no multi-factor authentication gave DarkSide ransomware operators access to Colonial Pipeline's IT network. The company shut down 5,500 miles of pipeline carrying 45% of the US East Coast's fuel as a precaution. The ransomware never reached the operational technology.

The Exchange ProxyLogon Attack: How Four Zero-Days Gave HAFNIUM Access to 250,000 Servers

In March 2021, the HAFNIUM threat group exploited four zero-day vulnerabilities in Microsoft Exchange Server to compromise over 250,000 servers worldwide. The attack chain turned a single server-side request forgery into full remote code execution without any authentication. Multiple governments attributed the campaign to China's Ministry of State Security.

The NotPetya Attack: How a Tax Software Update Destroyed $10 Billion in 90 Minutes

NotPetya was a wiper disguised as ransomware, deployed through a supply chain compromise of Ukrainian tax software MeDoc. It combined EternalBlue, credential harvesting, and irreversible encryption to cause more than $10 billion in global damage. Full technical breakdown of the supply chain vector, propagation mechanics, and why paying the ransom was impossible by design.

15 min read

The SolarWinds SUNBURST Attack: How Clean Source Code Produced a Backdoor

How Russian intelligence poisoned SolarWinds' build system to inject a backdoor into 18,000 organisations while the source code remained untouched, and what the three-component attack chain reveals about supply chain trust.

The WannaCry Ransomware Attack: How a Kill Switch Stopped a Global Worm

How WannaCry infected more than 200,000 computers in 150 countries, disrupted 81 NHS trusts, and was stopped by a researcher who registered a domain name. Full technical breakdown of EternalBlue, the 59-day patch gap, and what the NAO investigation found.