{"id":14104,"date":"2023-03-22T00:00:00","date_gmt":"2023-03-22T07:00:00","guid":{"rendered":"https:\/\/www.syteca.com\/blog\/en-blog-real-life-examples-insider-threat-caused-breaches\/"},"modified":"2026-03-30T05:45:41","modified_gmt":"2026-03-30T12:45:41","slug":"real-life-examples-insider-threat-caused-breaches","status":"publish","type":"post","link":"https:\/\/www.syteca.com\/en\/blog\/real-life-examples-insider-threat-caused-breaches","title":{"rendered":"7 Examples of Real-Life Data Breaches Caused by Unmitigated Insider Threats"},"content":{"rendered":"\n<p>Insiders are already within your security perimeter, which makes harmful actions easier to execute and harder to spot. In this article, we analyze seven headline-making insider data breach examples. We also connect each one to practical controls you can implement to enhance your security. Read on and equip yourself with our clear checklist on how to reduce insider risk within your organization.<\/p>\n\n\n\n<p><strong>Key takeaways:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>According to numerous <a href=\"\/en\/blog\/insider-threat-statistics-facts-and-figures\" target=\"_blank\" rel=\"noreferrer noopener\">insider threat reports<\/a>, insider-driven security incidents occur across various industries and organizations of all sizes, demonstrating that no company is immune. Causes range from poor access control to users\u2019 carelessness.<\/li>\n\n\n\n<li>Even companies like Google, Marks &amp; Spencer, and Coinbase have fallen victim to significant data breaches, exposing millions of records and critical business information.<\/li>\n\n\n\n<li>Consequences of these breaches have included not only financial losses but also regulatory fines, lawsuits, and lasting reputational damage.<\/li>\n\n\n\n<li>Dedicated cybersecurity platforms can help you prevent similar incidents in your organization.<\/li>\n<\/ul>\n\n\n\n<h2  class=\"wp-block-heading\">Insider threats and their consequences<\/h2>\n\n\n\n<p>Let\u2019s start with the definition of an insider. The National Institute of Standards and Technology (NIST) <a href=\"https:\/\/nvlpubs.nist.gov\/nistpubs\/SpecialPublications\/NIST.SP.800-53r5.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Special Publication 800-53<\/a> defines an insider threat as \u201cthe threat that an insider will use her\/his authorized access, wittingly or unwittingly, to do harm to the security of organizational operations and assets, individuals, other organizations, and the Nation.\u201d<\/p>\n\n\n\n<p>There are three types of <a href=\"\/en\/blog\/insider-threat-statistics-facts-and-figures\" target=\"_blank\" rel=\"noreferrer noopener\">insider threats in cybersecurity<\/a>:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"387\" src=\"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031717\/1-7-Examples-of-Real-Life-Data-Breaches-1024x387.png\" alt=\"Types of insider threats\" class=\"wp-image-62821\" srcset=\"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031717\/1-7-Examples-of-Real-Life-Data-Breaches-1024x387.png 1024w, https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031717\/1-7-Examples-of-Real-Life-Data-Breaches-300x113.png 300w, https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031717\/1-7-Examples-of-Real-Life-Data-Breaches-768x290.png 768w, https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031717\/1-7-Examples-of-Real-Life-Data-Breaches-1536x581.png 1536w, https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031717\/1-7-Examples-of-Real-Life-Data-Breaches.png 1650w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Insider attacks are particularly dangerous for three main reasons:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Most of the time, insiders\u2019 actions are not malicious, making harmful insider activity difficult to detect.<\/li>\n\n\n\n<li>Insiders know the weaknesses in your organization\u2019s cybersecurity.<\/li>\n\n\n\n<li>Insiders know the location and nature of sensitive data they can exploit.<\/li>\n<\/ul>\n\n\n\n<p>For these reasons, insider attacks precisely target the most sensitive assets and take a long time to contain, resulting in devastating losses for organizations. The total average cost of insider threat incidents rose from $15.4 million in 2022 to $17.4 million in 2024, according to the<a href=\"https:\/\/www2.dtexsystems.com\/l\/464342\/2023-09-15\/3w7l7k\/464342\/1694800570ZwvyrzsD\/2023_Cost_of_Insider_Risks_Global_Report___Ponemon_and_DTEX___Dgtl.pdf\"> <\/a>2025 Cost of Insider Risks Global Report by the Ponemon Institute.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"385\" src=\"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031723\/2-7-Examples-of-Real-Life-Data-Breaches-1024x385.png\" alt=\"Average cost of insider-driven incidents\" class=\"wp-image-62828\" srcset=\"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031723\/2-7-Examples-of-Real-Life-Data-Breaches-1024x385.png 1024w, https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031723\/2-7-Examples-of-Real-Life-Data-Breaches-300x113.png 300w, https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031723\/2-7-Examples-of-Real-Life-Data-Breaches-768x289.png 768w, https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031723\/2-7-Examples-of-Real-Life-Data-Breaches-1536x577.png 1536w, https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031723\/2-7-Examples-of-Real-Life-Data-Breaches.png 1650w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>The <a href=\"\/en\/blog\/cyber-security-breaches-to-take-care-of\" target=\"_blank\" rel=\"noreferrer noopener\">consequences of cybersecurity breaches<\/a> caused by insiders can range from penalties for non-compliance with cybersecurity requirements to a loss of customer trust, especially when incidents involve <a href=\"\/en\/blog\/insider-fraud-prevention\" target=\"_blank\" rel=\"noreferrer noopener\">insider fraud<\/a> or deliberate misuse of access. Here are the most common outcomes among real-life cybersecurity incidents:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"676\" src=\"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031730\/3-7-Examples-of-Real-Life-Data-Breaches-1024x676.png\" alt=\"Common consequences of an insider attack\" class=\"wp-image-62835\" srcset=\"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031730\/3-7-Examples-of-Real-Life-Data-Breaches-1024x676.png 1024w, https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031730\/3-7-Examples-of-Real-Life-Data-Breaches-300x198.png 300w, https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031730\/3-7-Examples-of-Real-Life-Data-Breaches-768x507.png 768w, https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031730\/3-7-Examples-of-Real-Life-Data-Breaches-1536x1015.png 1536w, https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031730\/3-7-Examples-of-Real-Life-Data-Breaches.png 1650w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>In this article, we investigate seven notorious insider threat cases, examine their outcomes, and analyze how these attacks happened. We\u2019ll also show how these internal data breaches could have been prevented.<\/p>\n\n\n\n<h2  class=\"wp-block-heading\">7 examples of real-life data breaches caused by insider threats<\/h2>\n\n\n\n<p>We\u2019ve selected seven examples of data breaches driven by high-profile insider threats. These breaches, along with other infamous <a href=\"\/en\/blog\/top-10-best-known-cybersecurity-incidents-and-what-to-learn-from-them\" target=\"_blank\" rel=\"noreferrer noopener\">real-life examples of cybersecurity incidents<\/a>, illustrate common motives and sources of insider threats. They also highlight how a single incident can significantly harm a company as a whole.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Case #1: Social engineering and ransomware attack on Marks &amp; Spencer<\/h3>\n\n\n\n\t\t<div  class=\"block-7fe4fb4a-110d-4fb8-9c65-7dcafd97040c areoi-element container template-17 mx-0 mb-3 mt-4\">\n\t\t\t\n\t\t\t\n\n\t\t<div  class=\"block-5711e89f-0cc7-45ae-9531-a238663812a3 row areoi-element pb-2\">\n\t\t\t\n\n\t\t\t\n\n\t\t<div  class=\"block-bf814a89-3763-48c1-98a1-7af05932fc6a col areoi-element p-4 d-flex align-items-center justify-content-center col-12 col-md-4\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(26, 59, 78,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0 has-text-color\" style=\"color:#ffffff;font-size:1rem;font-style:normal;font-weight:600\">Affected entity<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-b95b8330-f366-4077-bf14-d4bedcc3bdfc col areoi-element p-2 col-12 col-md-8\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(240, 249, 252,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<figure class=\"wp-block-image size-full px-3\"><img decoding=\"async\" width=\"240\" height=\"180\" src=\"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031749\/logo-Marks-Spencer.png\" alt=\"\" class=\"wp-image-62877\"\/><\/figure>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-4cb88c8c-2ce8-4993-989e-4569b5ee7630 row areoi-element pb-2\">\n\t\t\t\n\n\t\t\t\n\n\t\t<div  class=\"block-13ae581d-a344-4027-8819-870241beb714 col areoi-element p-4 d-flex align-items-center justify-content-center col-12 col-md-4\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(26, 59, 78,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0 has-text-color\" style=\"color:#ffffff;font-size:1rem;font-style:normal;font-weight:600\">Incident type<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-75dbc584-5b66-4f4b-82e4-81469c2a09c5 col areoi-element p-4 col-12 col-md-8\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(240, 249, 252,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Social engineering attack against a third-party service provider<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-36350a44-5128-49ae-a8f4-e7dfb1b77fb7 row areoi-element pb-2\">\n\t\t\t\n\n\t\t\t\n\n\t\t<div  class=\"block-6ff6d3b7-5796-4948-8632-cf6cd56ee3fe col areoi-element p-4 d-flex align-items-center justify-content-center col-12 col-md-4\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(26, 59, 78,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0 has-text-color\" style=\"color:#ffffff;font-size:1rem;font-style:normal;font-weight:600\">Consequences<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-3760d338-45a6-4be3-b620-2906679e9fc0 col areoi-element p-4 col-12 col-md-8\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(240, 249, 252,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<ul class=\"wp-block-list list-marker-color-blue ps-0 ms-3 mb-0\">\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Operations disrupted across 1,049 stores<\/li>\n\n\n\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Online sales suspended for 5 days, with some product lines being offline for 46 days<\/li>\n\n\n\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Estimated daily revenue loss of \u00a33.8 million and hundreds of millions of pounds in total financial impact<\/li>\n\n\n\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Customer data exposed<\/li>\n\n\n\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Temporary drop in market value of \u00a3750 million<\/li>\n<\/ul>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-36350a44-5128-49ae-a8f4-e7dfb1b77fb7 row areoi-element pb-2\">\n\t\t\t\n\n\t\t\t\n\n\t\t<div  class=\"block-6ff6d3b7-5796-4948-8632-cf6cd56ee3fe col areoi-element p-4 d-flex align-items-center justify-content-center col-12 col-md-4\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(26, 59, 78,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0 has-text-color\" style=\"color:#ffffff;font-size:1rem;font-style:normal;font-weight:600\">Potential solutions<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-3760d338-45a6-4be3-b620-2906679e9fc0 col areoi-element p-4 col-12 col-md-8\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(240, 249, 252,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<ul class=\"wp-block-list list-marker-color-blue ps-0 ms-3 mb-0\">\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Multi-factor identity verification<\/li>\n\n\n\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">User activity monitoring<\/li>\n\n\n\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Cybersecurity awareness training<\/li>\n<\/ul>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\t\t\t \n\t\t<\/div>\n\t\n\n\n<h4 class=\"wp-block-heading mt-4\"><em>What happened?<\/em><\/h4>\n\n\n\n<p>In April 2025, the Scattered Spider group launched <a href=\"https:\/\/www.theguardian.com\/business\/2025\/apr\/25\/marks-and-spencer-pauses-online-orders-cyber-attack-fallout\" target=\"_blank\" rel=\"noreferrer noopener\">a social-engineering attack on Tata Consultancy Services<\/a>, Marks &amp; Spencer&#8217;s third-party service desk. They impersonated a Marks &amp; Spencer employee and convinced the support staff to reset a password, thereby gaining initial access to the company&#8217;s systems. Over time, they deployed ransomware on Marks &amp; Spencer&#8217;s VMware servers.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><em>What were the consequences? <\/em><\/h4>\n\n\n\n<p>Marks &amp; Spencer&#8217;s operations across more than 1,000 stores were affected, with online sales suspended for several days and some clothing lines unavailable for over a month. Marks &amp; Spencer reverted to manual stock and delivery tracking, losing roughly \u00a33.8 million per day during the downtime. Additionally, a limited amount of customer data was stolen, including contact details, dates of birth, and partial payment information. The company\u2019s market value fell by about \u00a3750 million.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><em>Why did it happen, and what could have prevented it?<\/em><\/h4>\n\n\n\n<p>This incident is one of many data protection breach examples showing how a single social-engineering call can exploit weak verification controls at a vendor\u2019s service desk. Stronger <a href=\"\/en\/blog\/third-party-providers\" target=\"_blank\" rel=\"noreferrer noopener\">third party security<\/a> (identity verification protocols, <a href=\"\/en\/blog\/multi-factor-authentication\" target=\"_blank\" rel=\"noreferrer noopener\">multi-factor authentication<\/a> for password resets, and continuous <a href=\"\/en\/solutions\/privileged-user-monitoring\" target=\"_blank\" rel=\"noreferrer noopener\">monitoring of privileged users<\/a>) could have prevented the compromise or detected it earlier. Additionally, regular <a href=\"\/en\/blog\/insider-threat-awareness\" target=\"_blank\" rel=\"noreferrer noopener\">cybersecurity awareness training<\/a> could have helped employees and service providers spot social engineering attacks.<\/p>\n\n\n\n<h3 class=\"wp-block-heading mt-5\">Case #2: Insider theft of AI trade secrets from Google<\/h3>\n\n\n\n\t\t<div  class=\"block-7fe4fb4a-110d-4fb8-9c65-7dcafd97040c areoi-element container template-17 mx-0 mb-3 mt-4\">\n\t\t\t\n\t\t\t\n\n\t\t<div  class=\"block-5711e89f-0cc7-45ae-9531-a238663812a3 row areoi-element pb-2\">\n\t\t\t\n\n\t\t\t\n\n\t\t<div  class=\"block-bf814a89-3763-48c1-98a1-7af05932fc6a col areoi-element p-4 d-flex align-items-center justify-content-center col-12 col-md-4\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(26, 59, 78,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0 has-text-color\" style=\"color:#ffffff;font-size:1rem;font-style:normal;font-weight:600\">Affected entity<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-b95b8330-f366-4077-bf14-d4bedcc3bdfc col areoi-element p-2 col-12 col-md-8\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(240, 249, 252,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<figure class=\"wp-block-image size-full px-3\"><img decoding=\"async\" width=\"400\" height=\"180\" src=\"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031746\/logo-google.png\" alt=\"\" class=\"wp-image-62870\" srcset=\"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031746\/logo-google.png 400w, https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031746\/logo-google-300x135.png 300w\" sizes=\"(max-width: 400px) 100vw, 400px\" \/><\/figure>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-4cb88c8c-2ce8-4993-989e-4569b5ee7630 row areoi-element pb-2\">\n\t\t\t\n\n\t\t\t\n\n\t\t<div  class=\"block-13ae581d-a344-4027-8819-870241beb714 col areoi-element p-4 d-flex align-items-center justify-content-center col-12 col-md-4\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(26, 59, 78,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0 has-text-color\" style=\"color:#ffffff;font-size:1rem;font-style:normal;font-weight:600\">Incident type<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-75dbc584-5b66-4f4b-82e4-81469c2a09c5 col areoi-element p-4 col-12 col-md-8\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(240, 249, 252,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Insider theft of trade secrets<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-36350a44-5128-49ae-a8f4-e7dfb1b77fb7 row areoi-element pb-2\">\n\t\t\t\n\n\t\t\t\n\n\t\t<div  class=\"block-6ff6d3b7-5796-4948-8632-cf6cd56ee3fe col areoi-element p-4 d-flex align-items-center justify-content-center col-12 col-md-4\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(26, 59, 78,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0 has-text-color\" style=\"color:#ffffff;font-size:1rem;font-style:normal;font-weight:600\">Consequences<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-3760d338-45a6-4be3-b620-2906679e9fc0 col areoi-element p-4 col-12 col-md-8\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(240, 249, 252,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<ul class=\"wp-block-list list-marker-color-blue ps-0 ms-3 mb-0\">\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">P500 trade-secret files stolen<\/li>\n\n\n\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">A decade of research compromised<\/li>\n\n\n\n<li class=\"p-poppins\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Heightened US-China espionage scrutiny<\/li>\n<\/ul>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-36350a44-5128-49ae-a8f4-e7dfb1b77fb7 row areoi-element pb-2\">\n\t\t\t\n\n\t\t\t\n\n\t\t<div  class=\"block-6ff6d3b7-5796-4948-8632-cf6cd56ee3fe col areoi-element p-4 d-flex align-items-center justify-content-center col-12 col-md-4\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(26, 59, 78,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0 has-text-color\" style=\"color:#ffffff;font-size:1rem;font-style:normal;font-weight:600\">Potential solutions<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-3760d338-45a6-4be3-b620-2906679e9fc0 col areoi-element p-4 col-12 col-md-8\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(240, 249, 252,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<ul class=\"wp-block-list list-marker-color-blue ps-0 ms-3 mb-0\">\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Continuous user activity monitoring and behavior analytics<\/li>\n\n\n\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Employee travel monitoring&nbsp;<\/li>\n\n\n\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Insider threat awareness training<\/li>\n<\/ul>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\t\t\t \n\t\t<\/div>\n\t\n\n\n<h4 class=\"wp-block-heading mt-4\"><em>What happened?<\/em><\/h4>\n\n\n\n<p>In March 2024, Linwei Ding, a Google software engineer, exploited his insider access <a href=\"https:\/\/www.reuters.com\/legal\/ex-google-engineer-faces-new-us-charges-he-stole-ai-secrets-chinese-companies-2025-02-05\/\" target=\"_blank\" rel=\"noreferrer noopener\">to steal 500 confidential files<\/a> containing the company\u2019s proprietary supercomputing data center architecture and AI chip designs.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><em>What were the consequences? <\/em><\/h4>\n\n\n\n<p>This case of <a href=\"\/en\/blog\/insider-data-theft-definition\" target=\"_blank\" rel=\"noreferrer noopener\">insider data theft<\/a> is one of the most serious examples of <a href=\"\/en\/blog\/prevent-industrial-espionage\" target=\"_blank\" rel=\"noreferrer noopener\">corporate espionage<\/a> in recent years, exposing more than ten years of Google\u2019s research and development. The incident became a notable data breach case study, alarming national security officials because the stolen data could bolster China\u2019s AI capabilities and undermine U.S. technological leadership. Experts estimate that similar acts of <a href=\"\/en\/blog\/best-practices-to-prevent-intellectual-property-theft\" target=\"_blank\" rel=\"noreferrer noopener\">intellectual property theft<\/a> cost the U.S. economy up to $600 billion annually.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><em><em>Why did it happen, and what could have prevented it?<\/em><\/em><\/h4>\n\n\n\n<p>Ding allegedly sought profit by promoting himself to Chinese AI firms. He even <a href=\"https:\/\/www.nbcnews.com\/tech\/innovation\/linwei-ding-google-software-engineer-alleged-thief-trade-secrets-rcna146623\" target=\"_blank\" rel=\"noreferrer noopener\">spent some time in China<\/a> instead of working full-time in the office in San Francisco. Continuous user activity monitoring, employee travel oversight, and behavioral analytics could have exposed his malicious actions earlier. In addition to these measures, regular insider threat awareness training has been shown to further reduce the risk of intellectual property loss.<\/p>\n\n\n\n<h3 class=\"wp-block-heading mt-5\">Case #3: Data leak by bribed insiders at Coinbase<\/h3>\n\n\n\n\t\t<div  class=\"block-7fe4fb4a-110d-4fb8-9c65-7dcafd97040c areoi-element container template-17 mx-0 mb-3 mt-4\">\n\t\t\t\n\t\t\t\n\n\t\t<div  class=\"block-5711e89f-0cc7-45ae-9531-a238663812a3 row areoi-element pb-2\">\n\t\t\t\n\n\t\t\t\n\n\t\t<div  class=\"block-bf814a89-3763-48c1-98a1-7af05932fc6a col areoi-element p-4 d-flex align-items-center justify-content-center col-12 col-md-4\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(26, 59, 78,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0 has-text-color\" style=\"color:#ffffff;font-size:1rem;font-style:normal;font-weight:600\">Affected entity<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-b95b8330-f366-4077-bf14-d4bedcc3bdfc col areoi-element p-2 col-12 col-md-8\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(240, 249, 252,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<figure class=\"wp-block-image size-full px-3\"><img decoding=\"async\" width=\"400\" height=\"180\" src=\"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031741\/logo-coinbase.png\" alt=\"\" class=\"wp-image-62856\" srcset=\"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031741\/logo-coinbase.png 400w, https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031741\/logo-coinbase-300x135.png 300w\" sizes=\"(max-width: 400px) 100vw, 400px\" \/><\/figure>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-4cb88c8c-2ce8-4993-989e-4569b5ee7630 row areoi-element pb-2\">\n\t\t\t\n\n\t\t\t\n\n\t\t<div  class=\"block-13ae581d-a344-4027-8819-870241beb714 col areoi-element p-4 d-flex align-items-center justify-content-center col-12 col-md-4\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(26, 59, 78,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0 has-text-color\" style=\"color:#ffffff;font-size:1rem;font-style:normal;font-weight:600\">Incident type<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-75dbc584-5b66-4f4b-82e4-81469c2a09c5 col areoi-element p-4 col-12 col-md-8\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(240, 249, 252,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Abuse of authorized access by customer support agents who accepted bribes<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-36350a44-5128-49ae-a8f4-e7dfb1b77fb7 row areoi-element pb-2\">\n\t\t\t\n\n\t\t\t\n\n\t\t<div  class=\"block-6ff6d3b7-5796-4948-8632-cf6cd56ee3fe col areoi-element p-4 d-flex align-items-center justify-content-center col-12 col-md-4\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(26, 59, 78,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0 has-text-color\" style=\"color:#ffffff;font-size:1rem;font-style:normal;font-weight:600\">Consequences<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-3760d338-45a6-4be3-b620-2906679e9fc0 col areoi-element p-4 col-12 col-md-8\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(240, 249, 252,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<ul class=\"wp-block-list list-marker-color-blue ps-0 ms-3 mb-0\">\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Data of nearly 70,000 users exposed<\/li>\n\n\n\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Up to $400 million in remediation and reimbursement costs<\/li>\n\n\n\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Stock drop of 6%<\/li>\n<\/ul>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-36350a44-5128-49ae-a8f4-e7dfb1b77fb7 row areoi-element pb-2\">\n\t\t\t\n\n\t\t\t\n\n\t\t<div  class=\"block-6ff6d3b7-5796-4948-8632-cf6cd56ee3fe col areoi-element p-4 d-flex align-items-center justify-content-center col-12 col-md-4\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(26, 59, 78,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0 has-text-color\" style=\"color:#ffffff;font-size:1rem;font-style:normal;font-weight:600\">Potential solutions<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-3760d338-45a6-4be3-b620-2906679e9fc0 col areoi-element p-4 col-12 col-md-8\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(240, 249, 252,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<ul class=\"wp-block-list list-marker-color-blue ps-0 ms-3 mb-0\">\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Enhanced third-party access control<\/li>\n\n\n\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Continuous insider activity monitoring and threat detection<\/li>\n<\/ul>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\t\t\t \n\t\t<\/div>\n\t\n\n\n<h4 class=\"wp-block-heading mt-4\"><em>What happened?<\/em><\/h4>\n\n\n\n<p>Coinbase confirmed that a group of overseas support agents was bribed to steal <a href=\"https:\/\/www.cnbc.com\/2025\/05\/15\/coinbase-says-hackers-bribed-staff-to-steal-customer-data-and-are-demanding-20-million-ransom.html\" target=\"_blank\" rel=\"noreferrer noopener\">personal data of nearly 1% of its customer base<\/a>. The attack began in late December 2024 and surfaced publicly when the attackers demanded a $20 million ransom in May 2025.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><em>What were the consequences? <\/em><\/h4>\n\n\n\n<p>The breach exposed the information of nearly 70,000 people, including IDs and contact details. Coinbase incurred up to $400 million in damages and experienced a 6% decline in share value. The company also devoted resources to fully reimbursing affected customers and enhancing user oversight and fraud detection.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><em><em>Why did it happen, and what could have prevented it?<\/em><\/em><\/h4>\n\n\n\n<p>Financially motivated insiders exploited legitimate access to <a href=\"\/en\/blog\/prevent-data-exfiltration\" target=\"_blank\" rel=\"noreferrer noopener\">exfiltrate data<\/a>. Such real-life insider threat examples highlight the importance of enhanced <a href=\"\/en\/product\/privileged-access-management\" target=\"_blank\" rel=\"noreferrer noopener\">access restrictions<\/a> and <a href=\"\/en\/solutions\/preventing-insider-threat\" target=\"_blank\" rel=\"noreferrer noopener\">insider threat detection tools<\/a> could have prevented or quickly revealed the scheme.<\/p>\n\n\n\n\t\t<div  class=\"block-7b16823c-3c96-4368-92ff-0b56ebf357de areoi-element pattern-read-also rounded-bg-13px\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(16, 206, 158,0.1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins opacity-50 has-text-color\" style=\"color:#1a3b4e;font-style:normal;font-weight:500\">Learn more about<\/p>\n\n\n\n<p class=\"p-poppins\" style=\"font-size:1.38rem;font-style:normal;font-weight:600\"><a href=\"\/en\/product\/user-activity-monitoring\" target=\"_blank\" rel=\"noreferrer noopener\">User Activity Monitoring with Syteca<\/a><\/p>\n\n\n\t\t\t \n\t\t<\/div>\n\t\n\n\n<h3 class=\"wp-block-heading mt-5\">Case #4: Accidental exposure of British Special Forces identities<\/h3>\n\n\n\n\t\t<div  class=\"block-7fe4fb4a-110d-4fb8-9c65-7dcafd97040c areoi-element container template-17 mx-0 mb-3 mt-4\">\n\t\t\t\n\t\t\t\n\n\t\t<div  class=\"block-5711e89f-0cc7-45ae-9531-a238663812a3 row areoi-element pb-2\">\n\t\t\t\n\n\t\t\t\n\n\t\t<div  class=\"block-bf814a89-3763-48c1-98a1-7af05932fc6a col areoi-element p-4 d-flex align-items-center justify-content-center col-12 col-md-4\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(26, 59, 78,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0 has-text-color\" style=\"color:#ffffff;font-size:1rem;font-style:normal;font-weight:600\">Affected entity<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-b95b8330-f366-4077-bf14-d4bedcc3bdfc col areoi-element p-2 col-12 col-md-8\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(240, 249, 252,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<figure class=\"wp-block-image size-full px-3\"><img decoding=\"async\" width=\"220\" height=\"180\" src=\"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031751\/logo-mod.png\" alt=\"\" class=\"wp-image-62884\"\/><\/figure>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-4cb88c8c-2ce8-4993-989e-4569b5ee7630 row areoi-element pb-2\">\n\t\t\t\n\n\t\t\t\n\n\t\t<div  class=\"block-13ae581d-a344-4027-8819-870241beb714 col areoi-element p-4 d-flex align-items-center justify-content-center col-12 col-md-4\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(26, 59, 78,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0 has-text-color\" style=\"color:#ffffff;font-size:1rem;font-style:normal;font-weight:600\">Incident type<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-75dbc584-5b66-4f4b-82e4-81469c2a09c5 col areoi-element p-4 col-12 col-md-8\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(240, 249, 252,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Unintentional disclosure of sensitive information<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-36350a44-5128-49ae-a8f4-e7dfb1b77fb7 row areoi-element pb-2\">\n\t\t\t\n\n\t\t\t\n\n\t\t<div  class=\"block-6ff6d3b7-5796-4948-8632-cf6cd56ee3fe col areoi-element p-4 d-flex align-items-center justify-content-center col-12 col-md-4\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(26, 59, 78,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0 has-text-color\" style=\"color:#ffffff;font-size:1rem;font-style:normal;font-weight:600\">Consequences<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-3760d338-45a6-4be3-b620-2906679e9fc0 col areoi-element p-4 col-12 col-md-8\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(240, 249, 252,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<ul class=\"wp-block-list list-marker-color-blue ps-0 ms-3 mb-0\">\n<li class=\"p-poppins\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Exposure of soldiers&#8217; identities<\/li>\n\n\n\n<li class=\"p-poppins\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Risk to ongoing operations and personnel safety<\/li>\n<\/ul>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-36350a44-5128-49ae-a8f4-e7dfb1b77fb7 row areoi-element pb-2\">\n\t\t\t\n\n\t\t\t\n\n\t\t<div  class=\"block-6ff6d3b7-5796-4948-8632-cf6cd56ee3fe col areoi-element p-4 d-flex align-items-center justify-content-center col-12 col-md-4\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(26, 59, 78,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0 has-text-color\" style=\"color:#ffffff;font-size:1rem;font-style:normal;font-weight:600\">Potential solutions<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-3760d338-45a6-4be3-b620-2906679e9fc0 col areoi-element p-4 col-12 col-md-8\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(240, 249, 252,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<ul class=\"wp-block-list list-marker-color-blue ps-0 ms-3 mb-0\">\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Regular audits of online publications<\/li>\n\n\n\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Data protection and cybersecurity training for non-active military personnel<\/li>\n<\/ul>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\t\t\t \n\t\t<\/div>\n\t\n\n\n<h4 class=\"wp-block-heading mt-4\"><em>What happened?<\/em><\/h4>\n\n\n\n<p>In April 2025, it was revealed that the <a href=\"https:\/\/www.bbc.com\/news\/articles\/ceqrpdn8038o\" target=\"_blank\" rel=\"noreferrer noopener\">names and ranks of at least 20 members of the UK\u2019s elite Special Forces had been publicly available online<\/a> for over a decade through two publications linked to the Grenadier Guards.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><em>What were the consequences? <\/em><\/h4>\n\n\n\n<p>The exposure created a severe security risk for the individuals involved, as terrorists or hostile states could have easily linked names to Special Forces activity. Some soldiers were believed to be on active operations, which heightened the danger for them. The Ministry of Defence removed the files within hours of being alerted, notified the affected personnel, and launched a formal <a href=\"\/en\/solutions\/investigate-security-incidents\" target=\"_blank\" rel=\"noreferrer noopener\">investigation<\/a> into data-handling procedures.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><em><em>Why did it happen, and what could have prevented it?<\/em><\/em><\/h4>\n\n\n\n<p>This incident is one of many examples of data breaches caused by insiders, where sensitive documents intended for internal military use were <a href=\"\/en\/blog\/inadvertent-privileged-user-mistakes\" target=\"_blank\" rel=\"noreferrer noopener\">inadvertently<\/a> published online without protection. Cybersecurity awareness training for all personnel handling sensitive military information would also have helped secure the sensitive data. Regular audits of public content could have prevented the <a href=\"\/en\/glossary\/what-is-data-leak\" target=\"_blank\" rel=\"noreferrer noopener\">data leak<\/a>.<\/p>\n\n\n\n\t\t<div  class=\"block-127edd59-e692-4dda-bf4f-9fdd8fb7751e areoi-element syteca-pattern-cta-7 container\">\n\t\t\t\n\t\t\t\n\n<p class=\"has-text-align-left text-36-28 text-center text-md-start p-poppins mb-0 has-text-color has-link-color wp-elements-d58fa89f48f255dac038cec136c2a85c\" style=\"color:#ffffff;font-style:normal;font-weight:600\">See Syteca in action!<\/p>\n\n\n\n<p class=\"has-text-color has-link-color wp-elements-fcb5ac29a1e5cfc736ee9cb335c4cae3\" style=\"color:#fffefe;font-style:normal;font-weight:600\">Request a demo to see how Syteca can protect your sensitive data from insider-driven breaches.<\/p>\n\n\n\n\t\t<div  class=\"block-6f6a6c26-e987-47e6-9f73-1fca4ea3a8e4 areoi-element cta-buttons-block mt-3 pt-3 text-center text-md-start\">\n\t\t\t\n\t\t\t\n\n\t\t\t\t\n\t\t<a data-bs-target=\"#hsModal-demo\" data-bs-toggle=\"modal\" \n\t\t\t\n\t\t\tclass=\"block-3ac41b93-dde5-4f3e-acbb-00e4897f448b btn areoi-has-url position-relative hsBtn-demo btn-primary\"\n\t >\n\t\t\t\t\t\n\t\t\t\t\tAccess the Demo Portal \n\t\t\t\t\t\n\t\t\t\t\t \n\t\t\t\t<\/a>\n\t\t\t\n\n\t\t\t \n\t\t<\/div>\n\t\n\n\t\t\t \n\t\t<\/div>\n\t\n\n\n<h3 class=\"wp-block-heading mt-5\">Case #5: Ransomware attack on Change Healthcare<\/h3>\n\n\n\n\t\t<div  class=\"block-7fe4fb4a-110d-4fb8-9c65-7dcafd97040c areoi-element container template-17 mx-0 mb-3 mt-4\">\n\t\t\t\n\t\t\t\n\n\t\t<div  class=\"block-5711e89f-0cc7-45ae-9531-a238663812a3 row areoi-element pb-2\">\n\t\t\t\n\n\t\t\t\n\n\t\t<div  class=\"block-bf814a89-3763-48c1-98a1-7af05932fc6a col areoi-element p-4 d-flex align-items-center justify-content-center col-12 col-md-4\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(26, 59, 78,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0 has-text-color\" style=\"color:#ffffff;font-size:1rem;font-style:normal;font-weight:600\">Affected entity<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-b95b8330-f366-4077-bf14-d4bedcc3bdfc col areoi-element p-2 col-12 col-md-8\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(240, 249, 252,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"360\" height=\"180\" src=\"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031738\/logo-change-healthcare.png\" alt=\"\" class=\"wp-image-62849\" srcset=\"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031738\/logo-change-healthcare.png 360w, https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031738\/logo-change-healthcare-300x150.png 300w\" sizes=\"(max-width: 360px) 100vw, 360px\" \/><\/figure>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-4cb88c8c-2ce8-4993-989e-4569b5ee7630 row areoi-element pb-2\">\n\t\t\t\n\n\t\t\t\n\n\t\t<div  class=\"block-13ae581d-a344-4027-8819-870241beb714 col areoi-element p-4 d-flex align-items-center justify-content-center col-12 col-md-4\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(26, 59, 78,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0 has-text-color\" style=\"color:#ffffff;font-size:1rem;font-style:normal;font-weight:600\">Incident type<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-75dbc584-5b66-4f4b-82e4-81469c2a09c5 col areoi-element p-4 col-12 col-md-8\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(240, 249, 252,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Ransomware attack enabled by stolen credentials<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-36350a44-5128-49ae-a8f4-e7dfb1b77fb7 row areoi-element pb-2\">\n\t\t\t\n\n\t\t\t\n\n\t\t<div  class=\"block-6ff6d3b7-5796-4948-8632-cf6cd56ee3fe col areoi-element p-4 d-flex align-items-center justify-content-center col-12 col-md-4\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(26, 59, 78,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0 has-text-color\" style=\"color:#ffffff;font-size:1rem;font-style:normal;font-weight:600\">Consequences<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-3760d338-45a6-4be3-b620-2906679e9fc0 col areoi-element p-4 col-12 col-md-8\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(240, 249, 252,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<ul class=\"wp-block-list list-marker-color-blue ps-0 ms-3 mb-0\">\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Massive theft of PHI and sensitive data (~193 million individuals affected)<\/li>\n\n\n\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Severe operational outages across hospitals and pharmacies<\/li>\n<\/ul>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-36350a44-5128-49ae-a8f4-e7dfb1b77fb7 row areoi-element pb-2\">\n\t\t\t\n\n\t\t\t\n\n\t\t<div  class=\"block-6ff6d3b7-5796-4948-8632-cf6cd56ee3fe col areoi-element p-4 d-flex align-items-center justify-content-center col-12 col-md-4\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(26, 59, 78,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0 has-text-color\" style=\"color:#ffffff;font-size:1rem;font-style:normal;font-weight:600\">Potential solutions<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-3760d338-45a6-4be3-b620-2906679e9fc0 col areoi-element p-4 col-12 col-md-8\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(240, 249, 252,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<ul class=\"wp-block-list list-marker-color-blue ps-0 ms-3 mb-0\">\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Enhanced password management<\/li>\n\n\n\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Multi-factor identity verification<\/li>\n\n\n\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Continuous user activity monitoring<\/li>\n<\/ul>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\t\t\t \n\t\t<\/div>\n\t\n\n\n<h4 class=\"wp-block-heading mt-4\"><em>What happened?<\/em><\/h4>\n\n\n\n<p>In February 2024, <a href=\"https:\/\/techcrunch.com\/2024\/04\/30\/uhg-change-healthcare-ransomware-compromised-credentials-mfa\/\" target=\"_blank\" rel=\"noreferrer noopener\">attackers used compromised credentials<\/a> to remotely access Change Healthcare&#8217;s Citrix portal. After gaining entry, they moved through internal systems, extracted large volumes of sensitive health data, and deployed ransomware nine days later.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><em>What were the consequences? <\/em><\/h4>\n\n\n\n<p>The attack caused one of the most disruptive healthcare outages in U.S. history. Payment systems, pharmacy operations, and claims processing were delayed for months. Huge quantities of protected health information were stolen, resulting in federal investigations, hefty fines, and regulatory pressure.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><em><em>Why did it happen, and what could have prevented it?<\/em><\/em><\/h4>\n\n\n\n<p>Change Healthcare&#8217;s Citrix portal did not have multifactor authentication enabled, allowing the intruders to bypass security controls. Stronger <a href=\"\/en\/blog\/healthcare-data-protection-solutions-monitor-and-audit-your-software\" target=\"_blank\" rel=\"noreferrer noopener\">healthcare data security<\/a> and more rigorous <a href=\"https:\/\/www.syteca.com\/en\/blog\/password-management-best-practices\">password management practices<\/a> could have prevented credentials from being stolen, while multi-factor authentication could have blocked the attackers\u2019 attempts to access the company\u2019s systems. Real-time monitoring could have helped security officers detect and block the malicious activity, while a swift <a href=\"\/en\/blog\/data-breach-investigation-best-practices\" target=\"_blank\" rel=\"noreferrer noopener\">data breach response<\/a> could have minimized the impact.<\/p>\n\n\n\n\t\t<div  class=\"block-83770525-c635-4e46-b3a2-c1df93819e7d areoi-element pattern-read-also rounded-bg-13px\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(16, 206, 158,0.1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins opacity-50 has-text-color\" style=\"color:#1a3b4e;font-style:normal;font-weight:500\">Learn more about<\/p>\n\n\n\n<p class=\"p-poppins\" style=\"font-size:1.38rem;font-style:normal;font-weight:600\"><a href=\"\/en\/product\/privileged-access-management\" target=\"_blank\" rel=\"noreferrer noopener\">Privileged Access Management with Syteca<\/a><\/p>\n\n\n\t\t\t \n\t\t<\/div>\n\t\n\n\n<h3 class=\"wp-block-heading mt-5\">Case #6: Insider sabotage at OPEXUS<\/h3>\n\n\n\n\t\t<div  class=\"block-7fe4fb4a-110d-4fb8-9c65-7dcafd97040c areoi-element container template-17 mx-0 mb-3 mt-4\">\n\t\t\t\n\t\t\t\n\n\t\t<div  class=\"block-5711e89f-0cc7-45ae-9531-a238663812a3 row areoi-element pb-2\">\n\t\t\t\n\n\t\t\t\n\n\t\t<div  class=\"block-bf814a89-3763-48c1-98a1-7af05932fc6a col areoi-element p-4 d-flex align-items-center justify-content-center col-12 col-md-4\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(26, 59, 78,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0 has-text-color\" style=\"color:#ffffff;font-size:1rem;font-style:normal;font-weight:600\">Affected entity<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-b95b8330-f366-4077-bf14-d4bedcc3bdfc col areoi-element p-2 col-12 col-md-8\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(240, 249, 252,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<figure class=\"wp-block-image size-full px-3\"><img decoding=\"async\" width=\"400\" height=\"180\" src=\"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031753\/logo-opexus.png\" alt=\"\" class=\"wp-image-62891\" srcset=\"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031753\/logo-opexus.png 400w, https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031753\/logo-opexus-300x135.png 300w\" sizes=\"(max-width: 400px) 100vw, 400px\" \/><\/figure>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-4cb88c8c-2ce8-4993-989e-4569b5ee7630 row areoi-element pb-2\">\n\t\t\t\n\n\t\t\t\n\n\t\t<div  class=\"block-13ae581d-a344-4027-8819-870241beb714 col areoi-element p-4 d-flex align-items-center justify-content-center col-12 col-md-4\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(26, 59, 78,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0 has-text-color\" style=\"color:#ffffff;font-size:1rem;font-style:normal;font-weight:600\">Incident type<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-75dbc584-5b66-4f4b-82e4-81469c2a09c5 col areoi-element p-4 col-12 col-md-8\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(240, 249, 252,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Insider sabotage by two engineers<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-36350a44-5128-49ae-a8f4-e7dfb1b77fb7 row areoi-element pb-2\">\n\t\t\t\n\n\t\t\t\n\n\t\t<div  class=\"block-6ff6d3b7-5796-4948-8632-cf6cd56ee3fe col areoi-element p-4 d-flex align-items-center justify-content-center col-12 col-md-4\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(26, 59, 78,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0 has-text-color\" style=\"color:#ffffff;font-size:1rem;font-style:normal;font-weight:600\">Consequences<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-3760d338-45a6-4be3-b620-2906679e9fc0 col areoi-element p-4 col-12 col-md-8\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(240, 249, 252,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<ul class=\"wp-block-list list-marker-color-blue ps-0 ms-3 mb-0\">\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">33 databases deleted and 1,805 files stolen<\/li>\n\n\n\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Weeks of U.S. federal systems outage<\/li>\n\n\n\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">FBI-led investigations leading to the risk of lost contacts<\/li>\n<\/ul>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-36350a44-5128-49ae-a8f4-e7dfb1b77fb7 row areoi-element pb-2\">\n\t\t\t\n\n\t\t\t\n\n\t\t<div  class=\"block-6ff6d3b7-5796-4948-8632-cf6cd56ee3fe col areoi-element p-4 d-flex align-items-center justify-content-center col-12 col-md-4\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(26, 59, 78,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0 has-text-color\" style=\"color:#ffffff;font-size:1rem;font-style:normal;font-weight:600\">Potential solutions<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-3760d338-45a6-4be3-b620-2906679e9fc0 col areoi-element p-4 col-12 col-md-8\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(240, 249, 252,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<ul class=\"wp-block-list list-marker-color-blue ps-0 ms-3 mb-0\">\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Strict background checks<\/li>\n\n\n\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Revoking access immediately upon termination<\/li>\n\n\n\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Continuous insider activity monitoring<\/li>\n<\/ul>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\t\t\t \n\t\t<\/div>\n\t\n\n\n<h4 class=\"wp-block-heading mt-4\"><em>What happened?<\/em><\/h4>\n\n\n\n<p>In February 2025, two disgruntled OPEXUS engineers, Suhaib and Muneeb Akhter, <a href=\"https:\/\/www.insurancejournal.com\/news\/national\/2025\/05\/21\/824641.htm\" target=\"_blank\" rel=\"noreferrer noopener\">exploited their insider access to sabotage critical infrastructure<\/a>, erasing 33 databases and stealing 1,805 sensitive U.S. government files, shortly after receiving notice of their termination.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><em>What were the consequences? <\/em><\/h4>\n\n\n\n<p>The attack disabled U.S. government tools like FOIAXpress and eCASE, erasing FOIA requests across agencies and drawing the immediate attention of the FBI and DHS. As a result, the Department of Health and Human Services reportedly considered terminating its agreement with OPEXUS.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><em><em>Why did it happen, and what could have prevented it?<\/em><\/em><\/h4>\n\n\n\n<p>OPEXUS hired the engineers responsible despite past hacking convictions and failed to revoke their access during offboarding. Stronger background screening, automated access termination, and real-time insider monitoring would have prevented the sabotage.<\/p>\n\n\n\n\t\t<div  class=\"block-557f3d77-e2e2-4ed8-8a83-1e8c0ed68b48 areoi-element pattern-read-also rounded-bg-13px pattern-case-studies-with-img\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(242, 250, 254,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins opacity-50 has-text-color\" style=\"color:#1a3b4e;font-style:normal;font-weight:500\">Case study<\/p>\n\n\n\n\t\t<div  class=\"block-f2941198-d283-403b-b626-fa96cbd2d157 areoi-element d-flex justify-content-between\">\n\t\t\t\n\t\t\t\n\n<p class=\"col-md-9 p-poppins mb-0 ms-0 mt-0 position-relative\" style=\"font-size:1.38rem;font-style:normal;font-weight:600\">Eilat Port Monitors the Activity of External Developers Within Their Servers with Syteca<\/p>\n\n\n\n<figure class=\"wp-block-image size-large col-md-3 cs-img d-none d-md-flex flex-wrap align-content-end overflow-hidden\"><img decoding=\"async\" src=\"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2025\/04\/08000009\/prev-casestudy-Eilat-Port.png\" alt=\"\"\/><\/figure>\n\n\n\t\t\t \n\t\t<\/div>\n\t\n\n\t\t\t\n\t\t\t<a class=\"areoi-full-link\"\n\t\t href=\"\/en\/resources\/case-studies\/eilat-port\" rel=\"noopener noreferrer\" target=\"_blank\"><\/a> \n\t\t<\/div>\n\t\n\n\n<h3 class=\"wp-block-heading mt-5\">Case #7: Exposure of customer data by a former employee at FinWise Bank<\/h3>\n\n\n\n\t\t<div  class=\"block-7fe4fb4a-110d-4fb8-9c65-7dcafd97040c areoi-element container template-17 mx-0 mb-3 mt-4\">\n\t\t\t\n\t\t\t\n\n\t\t<div  class=\"block-5711e89f-0cc7-45ae-9531-a238663812a3 row areoi-element pb-2\">\n\t\t\t\n\n\t\t\t\n\n\t\t<div  class=\"block-bf814a89-3763-48c1-98a1-7af05932fc6a col areoi-element p-4 d-flex align-items-center justify-content-center col-12 col-md-4\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(26, 59, 78,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0 has-text-color\" style=\"color:#ffffff;font-size:1rem;font-style:normal;font-weight:600\">Affected entity<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-b95b8330-f366-4077-bf14-d4bedcc3bdfc col areoi-element p-2 col-12 col-md-8\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(240, 249, 252,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<figure class=\"wp-block-image size-full px-3\"><img decoding=\"async\" width=\"400\" height=\"180\" src=\"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031744\/logo-finwise.png\" alt=\"\" class=\"wp-image-62863\" srcset=\"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031744\/logo-finwise.png 400w, https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031744\/logo-finwise-300x135.png 300w\" sizes=\"(max-width: 400px) 100vw, 400px\" \/><\/figure>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-4cb88c8c-2ce8-4993-989e-4569b5ee7630 row areoi-element pb-2\">\n\t\t\t\n\n\t\t\t\n\n\t\t<div  class=\"block-13ae581d-a344-4027-8819-870241beb714 col areoi-element p-4 d-flex align-items-center justify-content-center col-12 col-md-4\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(26, 59, 78,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0 has-text-color\" style=\"color:#ffffff;font-size:1rem;font-style:normal;font-weight:600\">Incident type<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-75dbc584-5b66-4f4b-82e4-81469c2a09c5 col areoi-element p-4 col-12 col-md-8\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(240, 249, 252,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Insider breach by a former employee<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-36350a44-5128-49ae-a8f4-e7dfb1b77fb7 row areoi-element pb-2\">\n\t\t\t\n\n\t\t\t\n\n\t\t<div  class=\"block-6ff6d3b7-5796-4948-8632-cf6cd56ee3fe col areoi-element p-4 d-flex align-items-center justify-content-center col-12 col-md-4\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(26, 59, 78,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0 has-text-color\" style=\"color:#ffffff;font-size:1rem;font-style:normal;font-weight:600\">Consequences<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-3760d338-45a6-4be3-b620-2906679e9fc0 col areoi-element p-4 col-12 col-md-8\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(240, 249, 252,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<ul class=\"wp-block-list list-marker-color-blue ps-0 ms-3 mb-0\">\n<li class=\"p-poppins\" style=\"font-size:1rem;font-style:normal;font-weight:600\">689,000 people\u2019s SSNs and account data exposed<\/li>\n\n\n\n<li class=\"p-poppins\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Six lawsuits demanding over $5 million in total<\/li>\n<\/ul>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-36350a44-5128-49ae-a8f4-e7dfb1b77fb7 row areoi-element pb-2\">\n\t\t\t\n\n\t\t\t\n\n\t\t<div  class=\"block-6ff6d3b7-5796-4948-8632-cf6cd56ee3fe col areoi-element p-4 d-flex align-items-center justify-content-center col-12 col-md-4\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(26, 59, 78,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"p-poppins mb-0 has-text-color\" style=\"color:#ffffff;font-size:1rem;font-style:normal;font-weight:600\">Potential solutions<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-3760d338-45a6-4be3-b620-2906679e9fc0 col areoi-element p-4 col-12 col-md-8\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(240, 249, 252,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<ul class=\"wp-block-list list-marker-color-blue ps-0 ms-3 mb-0\">\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Proper offboarding procedure<\/li>\n\n\n\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Tightened access management<\/li>\n\n\n\n<li class=\"p-poppins mb-2\" style=\"font-size:1rem;font-style:normal;font-weight:600\">Continuous user activity monitoring<\/li>\n<\/ul>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\t\t\t \n\t\t<\/div>\n\t\n\n\n<h4 class=\"wp-block-heading mt-4\"><em>What happened?<\/em><\/h4>\n\n\n\n<p>In May 2024, FinWise Bank <a href=\"https:\/\/www.securityweek.com\/689000-affected-by-insider-breach-at-finwise-bank\/#:~:text=has%20impacted%20689%2C000%20individuals\" target=\"_blank\" rel=\"noreferrer noopener\">experienced an insider data breach<\/a> when a former employee accessed internal systems after their employment had ended. This incident is an example of security breaches involving improper access management, where the individual accessed personal information belonging to 689,000 customers of American First Finance (AFF), a partner organization. The accessed data included names, birth dates, Social Security numbers, and account details.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><em>What were the consequences? <\/em><\/h4>\n\n\n\n<p>FinWise faced legal action, with six lawsuits accusing them and their partner of negligence and insufficient security practices. The plaintiffs demand over $5 million in relief and identity theft protection, such as lifetime credit monitoring. The bank\u2019s reputation was damaged, and the incident attracted the attention of industry regulators.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><em><em>Why did it happen, and what could have prevented it?<\/em><\/em><\/h4>\n\n\n\n<p>The breach occurred because a former employee retained valid access, and the bank lacked visibility into account use. Better offboarding procedures, including immediate access revocation and continuous activity monitoring, could have mitigated the damage from this <a href=\"\/en\/blog\/data-theft-by-departing-employees\" target=\"_blank\" rel=\"noreferrer noopener\">employee data theft<\/a>.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/www.syteca.com\/en\/resources\/white-papers\/how-to-build-an-insider-threat-program-10-step-checklist\" target=\"_blank\" rel=\"noopener\"><img decoding=\"async\" width=\"1024\" height=\"318\" src=\"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16045455\/WP-Insider-threat-program-banner-1024x318.png\" alt=\"\" class=\"wp-image-62912\" srcset=\"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16045455\/WP-Insider-threat-program-banner-1024x318.png 1024w, https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16045455\/WP-Insider-threat-program-banner-300x93.png 300w, https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16045455\/WP-Insider-threat-program-banner-768x238.png 768w, https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16045455\/WP-Insider-threat-program-banner-1536x477.png 1536w, https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16045455\/WP-Insider-threat-program-banner-2048x636.png 2048w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n\n\n\n<p class=\"mt-4\">In the next section, we show you how Syteca can help you prevent <a href=\"\/en\/blog\/top-10-best-known-cybersecurity-incidents-and-what-to-learn-from-them\" target=\"_blank\" rel=\"noreferrer noopener\">cybersecurity cases<\/a> like we described above. <\/p>\n\n\n\n<h2  class=\"wp-block-heading\">How to prevent insider-related breaches with Syteca<\/h2>\n\n\n\n<p>As real-world incidents show, insider attacks can strike any organization, often with devastating impact. But with the right tools, you can detect and respond to insider threats early.<\/p>\n\n\n\n<p>Syteca is a <a href=\"\/en\/product\/privileged-access-management\" target=\"_blank\" rel=\"noreferrer noopener\">privileged access management<\/a> (PAM) platform with identity threat detection and response (ITDR) at its core. The platform allows you to protect the inside perimeter of your organization against threats through these capabilities:<\/p>\n\n\n\n\t\t<div  class=\"block-04a15def-9297-4f23-bf53-20a8a0ca497c areoi-element container template-4 px-0\">\n\t\t\t\n\t\t\t\n\n\t\t<div  class=\"block-ce8be176-83cc-40dd-826c-b59b598bb70a areoi-element p-3 table-head\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(26, 59, 78,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"has-text-align-center p-poppins mb-0 has-text-color\" style=\"color:#ffffff;font-size:1.25rem;font-style:normal;font-weight:600\">Syteca\u2019s capabilities<\/p>\n\n\n\t\t\t \n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-db20c859-eb28-4f29-ab50-62a9cbdea2d7 areoi-element container\">\n\t\t\t\n\t\t\t\n\n\t\t<div  class=\"block-28b3d633-1691-4973-8d7b-d2c1838773fc row areoi-element row-cols-1 row-cols-md-3\">\n\t\t\t\n\n\t\t\t\n\n\t\t<div  class=\"block-1765243f-d41b-4e37-8d4d-7c7bde2c1da0 col areoi-element px-0 col-12 col-sm-6 col-md-6 col-lg-6 col-xl-6 col-xxl-6\">\n\t\t\t\n\t\t\t\n\n\t\t<div  class=\"block-1e8a9f72-6e48-4e74-8935-f42123d57b46 areoi-element sub-header\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(214, 222, 226,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"has-text-align-center mb-0 p-3\" style=\"font-size:1.19rem;font-style:normal;font-weight:600\">PAM<\/p>\n\n\n\t\t\t \n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-5ddb4ab0-cc83-40b6-863f-a9857000a57d row areoi-element mx-0 row-cols-1\">\n\t\t\t\n\n\t\t\t\n\n\t\t<div  class=\"block-827b4d90-706b-4090-a343-7ed959e9ddbf col areoi-element\">\n\t\t\t\n\t\t\t\n\n<p class=\"mb-0 p-4\" style=\"font-size:1.19rem;font-style:normal;font-weight:600\">Periodically scan your IT environment to <a href=\"\/en\/product\/privileged-account-discovery\" target=\"_blank\" rel=\"noreferrer noopener\">discover unmanaged privileged accounts<\/a> and mitigate hidden risks.<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-af6987dc-0ef5-413e-9f98-04085ef6ca68 col areoi-element\">\n\t\t\t\n\t\t\t\n\n<p class=\"mb-0 p-4\" style=\"font-size:1.19rem;font-style:normal;font-weight:600\"><a href=\"\/en\/product\/identity-management\" target=\"_blank\" rel=\"noreferrer noopener\">Control users\u2019 access to endpoints<\/a> and ensure that only authorized personnel can access your sensitive assets.<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-827b4d90-706b-4090-a343-7ed959e9ddbf col areoi-element\">\n\t\t\t\n\t\t\t\n\n<p class=\"mb-0 p-4\" style=\"font-size:1.19rem;font-style:normal;font-weight:600\">Enforce granular access controls and grant time-bound permissions.<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-9f445088-cfee-44ae-8c9a-a2290f9c2234 col areoi-element\">\n\t\t\t\n\t\t\t\n\n<p class=\"mb-0 p-4\" style=\"font-size:1.19rem;font-style:normal;font-weight:600\"><a href=\"\/en\/product\/workforce-password-management\" target=\"_blank\" rel=\"noreferrer noopener\">Safeguard account credentials<\/a> and provide employees with secure password-sharing tools to prevent compromise.<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-559b2b87-1152-49d9-8863-c8a2dff46657 col areoi-element px-0 col-12 col-sm-6 col-md-6 col-lg-6 col-xl-6 col-xxl-6\">\n\t\t\t\n\t\t\t\n\n\t\t<div  class=\"block-9cab978a-ad7c-4526-b607-49bd2557c5e3 areoi-element sub-header\">\n\t\t\t\n\t\t<div class=\"areoi-background  \">\n\t\t\t<div class=\"container-fluid\" style=\"padding: 0;\">\n\t\t\t\t<div class=\"row justify-content-start\">\n\t\t\t\t\t<div class=\"col \">\n\t\t\t            <div class=\"areoi-background__color\" \n\t                        \tstyle=\"background: rgba(214, 222, 226,1)\">\n\t                        <\/div>\n\n\t                    \n\n\t                    \n\n\t                    \n\t    \t\t\t<\/div>\n\t    \t\t<\/div>\n\t    \t<\/div>\n\t    <\/div>\n\t\n\t\t\t\n\n<p class=\"has-text-align-center mb-0 p-3\" style=\"font-size:1.19rem;font-style:normal;font-weight:600\">ITDR<\/p>\n\n\n\t\t\t \n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-d2c36afe-d5c2-43d8-83c2-77d70f3e8632 row areoi-element mx-0 row-cols-1\">\n\t\t\t\n\n\t\t\t\n\n\t\t<div  class=\"block-827b4d90-706b-4090-a343-7ed959e9ddbf col areoi-element\">\n\t\t\t\n\t\t\t\n\n<p class=\"mb-0 p-4\" style=\"font-size:1.19rem;font-style:normal;font-weight:600\"><a href=\"\/en\/product\/session-recording\" target=\"_blank\" rel=\"noreferrer noopener\">Capture users\u2019 on-screen activity<\/a> along with insightful metadata <a href=\"\/en\/user-privacy\" target=\"_blank\" rel=\"noreferrer noopener\">without compromising their privacy<\/a>.<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-af6987dc-0ef5-413e-9f98-04085ef6ca68 col areoi-element\">\n\t\t\t\n\t\t\t\n\n<p class=\"mb-0 p-4\" style=\"font-size:1.19rem;font-style:normal;font-weight:600\">Track <a href=\"\/en\/solutions\/third-party-vendor-monitoring\" target=\"_blank\" rel=\"noreferrer noopener\">third-party vendors&#8217;<\/a> activity to ensure their adherence to security policies and minimize security risks.<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-827b4d90-706b-4090-a343-7ed959e9ddbf col areoi-element\">\n\t\t\t\n\t\t\t\n\n<p class=\"mb-0 p-4\" style=\"font-size:1.19rem;font-style:normal;font-weight:600\"><a href=\"\/en\/product\/alerts-and-notifications\" target=\"_blank\" rel=\"noreferrer noopener\">Receive real-time alerts on suspicious user activity<\/a> and configure automated responses to quickly stop threats.<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t<div  class=\"block-7d828606-001b-4012-a695-816634dfe613 col areoi-element\">\n\t\t\t\n\t\t\t\n\n<p class=\"mb-0 p-4\" style=\"font-size:1.19rem;font-style:normal;font-weight:600\"><a href=\"\/en\/product\/reports-and-statistics\" target=\"_blank\" rel=\"noreferrer noopener\">Generate insightful user activity reports<\/a> to review trends in user activity and spot suspicious activity early.<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\t\t\t \n\t\t<\/div>\n\t\n\n\n<p>Syteca is quick and easy to deploy, which allows you to start enforcing insider threat protection faster. Pricing can be tailored to fit your budget, operations, and evolving cybersecurity needs. With Syteca, you can comfortably scale as your organization grows.&nbsp;<\/p>\n\n\n\n<p>Syteca is your reliable partner in mitigating insider risks.<\/p>\n\n\n\n\t\t<div  class=\"block-98e20eec-1b36-4542-b339-df6364452566 areoi-element syteca-pattern-cta-8 container\">\n\t\t\t\n\t\t\t\n\n<p class=\"has-text-align-left text-28-28-26 text-center text-md-start p-poppins mb-2 has-text-color has-link-color wp-elements-130da7ac8aaf0f705a4105aabd2fad29\" style=\"color:#ffffff;font-style:normal;font-weight:600\">Want to try Syteca?<br>Request access to the online demo!<\/p>\n\n\n\n<p class=\"has-text-align-left text-center text-md-start p-poppins mb-0 mt-1 has-text-color has-link-color wp-elements-6c4bcea7d7dd00d463ecbb9cd2970af2\" style=\"color:#ffffff;font-style:normal;font-weight:500\">See why clients from 70+ countries already use Syteca.<\/p>\n\n\n\n\t\t<div  class=\"block-b2cc5f9c-d0e2-4ece-935e-644cf8551a5c areoi-element cta-buttons-block mt-3 pt-3 text-center text-md-start\">\n\t\t\t\n\t\t\t\n\n\t\t\t\t\n\t\t<a data-bs-target=\"#hsModal-demo\" data-bs-toggle=\"modal\" \n\t\t\t\n\t\t\tclass=\"block-3ac41b93-dde5-4f3e-acbb-00e4897f448b btn areoi-has-url position-relative hsBtn-demo btn-primary\"\n\t >\n\t\t\t\t\t\n\t\t\t\t\tAccess the Demo Portal \n\t\t\t\t\t\n\t\t\t\t\t \n\t\t\t\t<\/a>\n\t\t\t\n\n\t\t\t \n\t\t<\/div>\n\t\n\n\t\t\t \n\t\t<\/div>\n\t","protected":false},"excerpt":{"rendered":"<p>Insiders are already within your security perimeter, which makes harmful actions easier to execute and harder to spot. In this article, we analyze seven headline-making insider data breach examples. We also connect each one to practical controls you can implement to enhance your security. Read on and equip yourself with our clear checklist on how [&hellip;]<\/p>\n","protected":false},"author":44,"featured_media":62842,"comment_status":"closed","ping_status":"open","sticky":true,"template":"","format":"standard","meta":{"footnotes":""},"categories":[58],"tags":[],"class_list":["post-14104","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-data-protection"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.0 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>7 Real-Life Data Breaches Caused by Insider Threats | Syteca<\/title>\n<meta name=\"description\" content=\"Find out about 7 real-life insider threat data breaches and their impact on the companies involved. \u26a1 Learn how Syteca helps prevent insider-related security incidents.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.syteca.com\/en\/blog\/real-life-examples-insider-threat-caused-breaches\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"7 Real-Life Data Breaches Caused by Insider Threats | Syteca\" \/>\n<meta property=\"og:description\" content=\"Find out about 7 real-life insider threat data breaches and their impact on the companies involved. \u26a1 Learn how Syteca helps prevent insider-related security incidents.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.syteca.com\/en\/blog\/real-life-examples-insider-threat-caused-breaches\" \/>\n<meta property=\"og:site_name\" content=\"Syteca\" \/>\n<meta property=\"article:published_time\" content=\"2023-03-22T07:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-03-30T12:45:41+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031758\/OG-7-Examples-of-Real-Life-Data-Breaches.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Liudmyla Pryimenko\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031801\/OG-TW-7-Examples-of-Real-Life-Data-Breaches.png\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Liudmyla Pryimenko\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"13 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.syteca.com\/en\/blog\/real-life-examples-insider-threat-caused-breaches#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.syteca.com\/en\/blog\/real-life-examples-insider-threat-caused-breaches\"},\"author\":{\"name\":\"Liudmyla Pryimenko\",\"@id\":\"https:\/\/www.syteca.com\/en\/#\/schema\/person\/ae5aa54483ac05594d6cb6aba1ead3d8\"},\"headline\":\"7 Examples of Real-Life Data Breaches Caused by Unmitigated Insider Threats\",\"datePublished\":\"2023-03-22T07:00:00+00:00\",\"dateModified\":\"2026-03-30T12:45:41+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.syteca.com\/en\/blog\/real-life-examples-insider-threat-caused-breaches\"},\"wordCount\":2324,\"image\":{\"@id\":\"https:\/\/www.syteca.com\/en\/blog\/real-life-examples-insider-threat-caused-breaches#primaryimage\"},\"thumbnailUrl\":\"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031736\/banner-7-Examples-of-Real-Life-Data-Breaches.png\",\"articleSection\":[\"Data Protection\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.syteca.com\/en\/blog\/real-life-examples-insider-threat-caused-breaches\",\"url\":\"https:\/\/www.syteca.com\/en\/blog\/real-life-examples-insider-threat-caused-breaches\",\"name\":\"7 Real-Life Data Breaches Caused by Insider Threats | Syteca\",\"isPartOf\":{\"@id\":\"https:\/\/www.syteca.com\/en\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.syteca.com\/en\/blog\/real-life-examples-insider-threat-caused-breaches#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.syteca.com\/en\/blog\/real-life-examples-insider-threat-caused-breaches#primaryimage\"},\"thumbnailUrl\":\"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031736\/banner-7-Examples-of-Real-Life-Data-Breaches.png\",\"datePublished\":\"2023-03-22T07:00:00+00:00\",\"dateModified\":\"2026-03-30T12:45:41+00:00\",\"author\":{\"@id\":\"https:\/\/www.syteca.com\/en\/#\/schema\/person\/ae5aa54483ac05594d6cb6aba1ead3d8\"},\"description\":\"Find out about 7 real-life insider threat data breaches and their impact on the companies involved. \u26a1 Learn how Syteca helps prevent insider-related security incidents.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.syteca.com\/en\/blog\/real-life-examples-insider-threat-caused-breaches#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.syteca.com\/en\/blog\/real-life-examples-insider-threat-caused-breaches\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.syteca.com\/en\/blog\/real-life-examples-insider-threat-caused-breaches#primaryimage\",\"url\":\"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031736\/banner-7-Examples-of-Real-Life-Data-Breaches.png\",\"contentUrl\":\"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031736\/banner-7-Examples-of-Real-Life-Data-Breaches.png\",\"width\":1920,\"height\":600},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.syteca.com\/en\/blog\/real-life-examples-insider-threat-caused-breaches#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Data Protection\",\"item\":\"https:\/\/www.syteca.com\/en\/blog\/category\/data-protection\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"7 Examples of Real-Life Data Breaches Caused by Unmitigated Insider Threats\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.syteca.com\/en\/#website\",\"url\":\"https:\/\/www.syteca.com\/en\/\",\"name\":\"Syteca\",\"description\":\"Syteca | software to monitor privileged users and audit employee activity, detect insider threats, and protect servers in real time. Try a free demo now!\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.syteca.com\/en\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.syteca.com\/en\/#\/schema\/person\/ae5aa54483ac05594d6cb6aba1ead3d8\",\"name\":\"Liudmyla Pryimenko\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.syteca.com\/en\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2024\/02\/20111324\/Liudmyla.png\",\"contentUrl\":\"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2024\/02\/20111324\/Liudmyla.png\",\"caption\":\"Liudmyla Pryimenko\"},\"description\":\"As a seasoned technical writer, Liudmyla excels in translating intricate information security and data protection concepts into clear and concise articles. With a meticulous approach, Liudmyla crafts comprehensive guides and articles that empower readers to navigate the complex landscape of cybersecurity. Her expertise lies in distilling intricate technical details into accessible content, making it a valuable resource for individuals and organizations seeking to enhance their understanding and implementation of robust security measures.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/in\/liudmyla-pryimenko-74877310a\/\"],\"url\":\"https:\/\/www.syteca.com\/en\/blog\/author\/liudmyla-pryimenko\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"7 Real-Life Data Breaches Caused by Insider Threats | Syteca","description":"Find out about 7 real-life insider threat data breaches and their impact on the companies involved. \u26a1 Learn how Syteca helps prevent insider-related security incidents.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.syteca.com\/en\/blog\/real-life-examples-insider-threat-caused-breaches","og_locale":"en_US","og_type":"article","og_title":"7 Real-Life Data Breaches Caused by Insider Threats | Syteca","og_description":"Find out about 7 real-life insider threat data breaches and their impact on the companies involved. \u26a1 Learn how Syteca helps prevent insider-related security incidents.","og_url":"https:\/\/www.syteca.com\/en\/blog\/real-life-examples-insider-threat-caused-breaches","og_site_name":"Syteca","article_published_time":"2023-03-22T07:00:00+00:00","article_modified_time":"2026-03-30T12:45:41+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031758\/OG-7-Examples-of-Real-Life-Data-Breaches.png","type":"image\/png"}],"author":"Liudmyla Pryimenko","twitter_card":"summary_large_image","twitter_image":"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031801\/OG-TW-7-Examples-of-Real-Life-Data-Breaches.png","twitter_misc":{"Written by":"Liudmyla Pryimenko","Est. reading time":"13 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.syteca.com\/en\/blog\/real-life-examples-insider-threat-caused-breaches#article","isPartOf":{"@id":"https:\/\/www.syteca.com\/en\/blog\/real-life-examples-insider-threat-caused-breaches"},"author":{"name":"Liudmyla Pryimenko","@id":"https:\/\/www.syteca.com\/en\/#\/schema\/person\/ae5aa54483ac05594d6cb6aba1ead3d8"},"headline":"7 Examples of Real-Life Data Breaches Caused by Unmitigated Insider Threats","datePublished":"2023-03-22T07:00:00+00:00","dateModified":"2026-03-30T12:45:41+00:00","mainEntityOfPage":{"@id":"https:\/\/www.syteca.com\/en\/blog\/real-life-examples-insider-threat-caused-breaches"},"wordCount":2324,"image":{"@id":"https:\/\/www.syteca.com\/en\/blog\/real-life-examples-insider-threat-caused-breaches#primaryimage"},"thumbnailUrl":"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031736\/banner-7-Examples-of-Real-Life-Data-Breaches.png","articleSection":["Data Protection"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.syteca.com\/en\/blog\/real-life-examples-insider-threat-caused-breaches","url":"https:\/\/www.syteca.com\/en\/blog\/real-life-examples-insider-threat-caused-breaches","name":"7 Real-Life Data Breaches Caused by Insider Threats | Syteca","isPartOf":{"@id":"https:\/\/www.syteca.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.syteca.com\/en\/blog\/real-life-examples-insider-threat-caused-breaches#primaryimage"},"image":{"@id":"https:\/\/www.syteca.com\/en\/blog\/real-life-examples-insider-threat-caused-breaches#primaryimage"},"thumbnailUrl":"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031736\/banner-7-Examples-of-Real-Life-Data-Breaches.png","datePublished":"2023-03-22T07:00:00+00:00","dateModified":"2026-03-30T12:45:41+00:00","author":{"@id":"https:\/\/www.syteca.com\/en\/#\/schema\/person\/ae5aa54483ac05594d6cb6aba1ead3d8"},"description":"Find out about 7 real-life insider threat data breaches and their impact on the companies involved. \u26a1 Learn how Syteca helps prevent insider-related security incidents.","breadcrumb":{"@id":"https:\/\/www.syteca.com\/en\/blog\/real-life-examples-insider-threat-caused-breaches#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.syteca.com\/en\/blog\/real-life-examples-insider-threat-caused-breaches"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.syteca.com\/en\/blog\/real-life-examples-insider-threat-caused-breaches#primaryimage","url":"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031736\/banner-7-Examples-of-Real-Life-Data-Breaches.png","contentUrl":"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/03\/16031736\/banner-7-Examples-of-Real-Life-Data-Breaches.png","width":1920,"height":600},{"@type":"BreadcrumbList","@id":"https:\/\/www.syteca.com\/en\/blog\/real-life-examples-insider-threat-caused-breaches#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Data Protection","item":"https:\/\/www.syteca.com\/en\/blog\/category\/data-protection"},{"@type":"ListItem","position":2,"name":"7 Examples of Real-Life Data Breaches Caused by Unmitigated Insider Threats"}]},{"@type":"WebSite","@id":"https:\/\/www.syteca.com\/en\/#website","url":"https:\/\/www.syteca.com\/en\/","name":"Syteca","description":"Syteca | software to monitor privileged users and audit employee activity, detect insider threats, and protect servers in real time. Try a free demo now!","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.syteca.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.syteca.com\/en\/#\/schema\/person\/ae5aa54483ac05594d6cb6aba1ead3d8","name":"Liudmyla Pryimenko","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.syteca.com\/en\/#\/schema\/person\/image\/","url":"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2024\/02\/20111324\/Liudmyla.png","contentUrl":"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2024\/02\/20111324\/Liudmyla.png","caption":"Liudmyla Pryimenko"},"description":"As a seasoned technical writer, Liudmyla excels in translating intricate information security and data protection concepts into clear and concise articles. With a meticulous approach, Liudmyla crafts comprehensive guides and articles that empower readers to navigate the complex landscape of cybersecurity. Her expertise lies in distilling intricate technical details into accessible content, making it a valuable resource for individuals and organizations seeking to enhance their understanding and implementation of robust security measures.","sameAs":["https:\/\/www.linkedin.com\/in\/liudmyla-pryimenko-74877310a\/"],"url":"https:\/\/www.syteca.com\/en\/blog\/author\/liudmyla-pryimenko"}]}},"_links":{"self":[{"href":"https:\/\/www.syteca.com\/en\/wp-json\/wp\/v2\/posts\/14104","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.syteca.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.syteca.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.syteca.com\/en\/wp-json\/wp\/v2\/users\/44"}],"replies":[{"embeddable":true,"href":"https:\/\/www.syteca.com\/en\/wp-json\/wp\/v2\/comments?post=14104"}],"version-history":[{"count":0,"href":"https:\/\/www.syteca.com\/en\/wp-json\/wp\/v2\/posts\/14104\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.syteca.com\/en\/wp-json\/wp\/v2\/media\/62842"}],"wp:attachment":[{"href":"https:\/\/www.syteca.com\/en\/wp-json\/wp\/v2\/media?parent=14104"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.syteca.com\/en\/wp-json\/wp\/v2\/categories?post=14104"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.syteca.com\/en\/wp-json\/wp\/v2\/tags?post=14104"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}