Insights & Intelligence

Real-World Incidents. Expert Analysis. Tactical Advice.

Subscribe to receive expert insights, practical tips, and updates on the latest trends in cybersecurity—delivered directly to your inbox.

Orchestrating Crisis: Why Incident Response Success Depends on Perfect Vendor Coordination

September 16, 2025

The most catastrophic failures in cyber incident response don’t stem from technical shortcomings—they result from poor coordination between external partners. Business leaders often engage vendors in isolation, assuming each will seamlessly handle their designated responsibilities. This approach fails spectacularly when crisis strikes.

A major cyber incident resembles a high-stakes orchestral performance where every instrument must play in perfect harmony. When one section falls out of tempo or hits a wrong note, the entire performance collapses.

Through years of navigating complex incident response scenarios, I’ve observed that success requires treating your external vendor team as a coordinated ensemble, with each playing a critical role:

The Essential Players

Legal Counsel: First-Chair Violin: Outside counsel sets the tempo from minute one. They establish attorney-client privilege to protect sensitive communications, advise on regulatory notification timelines (including SEC and HIPAA requirements), and define legal parameters for the entire investigation. Every strategic decision flows from their guidance—they’re not merely cleanup crew for the aftermath.

Digital Forensics: The Percussion Section: Forensics teams provide the factual foundation upon which all decisions rest. These investigators determine the fundamental questions: Who accessed what systems? When did the incident occur? What data was compromised? Is the threat actor still present in the network? Their findings aren’t technical minutiae—they’re irrefutable facts that drive every subsequent action.

Threat Actor Communications: The Featured Soloist: When ransom demands arrive, specialized negotiators take center stage. This delicate work requires trained professionals, not well-meaning executives. These experts engage adversaries, gather intelligence, buy critical time, and manage complex negotiations within boundaries established by legal counsel and executive leadership.

Public Relations: The Brass Section: Crisis communications teams control the narrative reaching customers, stakeholders, and media. Effective PR professionals transform verified forensic findings and legally-approved messaging into clear, confident, and transparent communications. Statements issued without forensic validation are mere speculation; those released without legal approval become potential liabilities.

Coordination in Action

The magic happens when these specialists perform in concert. Consider this sequence: Forensics discovers specific data types were stolen, enabling Legal to identify precise regulatory notification requirements and timelines. This intelligence flows to PR, allowing them to craft accurate public statements that avoid over-promising or misinforming stakeholders. Meanwhile, negotiators leverage this detailed understanding of the incident scope to engage effectively with threat actors.

Without coordination, chaos ensues. PR teams might publicly assure customers their data remains secure while forensics simultaneously discovers massive exfiltration. Legal counsel might prepare breach notifications based on incomplete information. The result is organizational discord when precision is paramount.

Strategic Recommendations

  1. Establish Relationships Before Crisis Strikes: Vet and retain key incident response vendors proactively. Your legal, forensics, and communications partners should know each other and maintain established collaboration protocols. Crisis is not the time for introductions.
  2. Rehearse Through Tabletop Exercises: Conduct scenario-based exercises involving all external parties. Challenge your legal and PR teams to respond to simulated forensic findings. This preparation builds the institutional muscle memory essential during actual incidents.
  3. Designate a Conductor: Successful response requires a single incident commander—whether internal staff or external consultant—who ensures information flows seamlessly between vendors and that every action aligns with broader business objectives.

Conclusion

Incident response represents the ultimate test of organizational leadership and preparedness. The question every executive should ask: Is your orchestra ready to perform when the curtain rises?


Flying Into Turbulence: How Scattered Spider Is Targeting Airlines with Social Engineering

June 30, 2025

Remember when the most annoying thing about air travel was paying $15 for a sandwich that tastes like cardboard? Well, buckle up—Scattered Spider, the cybercriminal group with a name that sounds like a rejected Marvel villain, has decided to make flying even more stressful by targeting airlines across North America.

The Spider’s Web Spreads to 30,000 Feet

The notorious hacking collective has set its sights on the aviation industry, successfully infiltrating multiple airlines in the US and Canada throughout June 2025. Hawaiian Airlines and WestJet have already confirmed they’re dealing with the aftermath of cyberattacks.

What makes this particularly frustrating is Scattered Spider’s approach: they’re masters of the oldest trick in the book—social engineering. Think of them as the used car salesmen of cybercrime, except instead of selling you a lemon, they’re stealing your entire digital infrastructure.

The Art of the Con: Why Call Centers Are Cybercriminal Gold Mines

Here’s where it gets both impressive and infuriating: Scattered Spider’s preferred attack vector is simply calling people. While we’re all busy patching systems and deploying AI-powered threat detection, these hackers are picking up the phone and pretending to be Karen from Accounting who forgot her password again.

Airlines are particularly vulnerable to this approach because they rely heavily on call centers for customer support, IT help desks, and vendor coordination. It’s a target-rich environment where a convincing voice and basic social engineering skills can open doors that would take traditional hackers weeks to crack.

As former Las Vegas airport CISO Aakin Patel noted, “Airlines rely heavily on call centers for a lot of their support needs, making them a likely target for groups like this.” It’s like building a fortress with titanium walls, then leaving the front door propped open with a sticky note reading, “Please don’t rob us.”

Patterns in the Chaos: Scattered Spider’s Sector Strategy

What’s particularly telling about Scattered Spider is their methodical approach to mayhem. They don’t randomly attack targets—they pick a sector and systematically work through it like items on a grocery list:

  • September 2023: Las Vegas casinos (MGM Resorts, Caesars Entertainment)
  • November 2024: Retail (Ahold Delhaize USA, parent company of Giant and Food Lion)
  • April 2025: Retail continued (Marks & Spencer, The Co-op, Harrods)
  • June 2025: Insurance sector (Aflac)
  • June 2025: Aviation industry (Hawaiian Airlines, WestJet Airlines)

This pattern suggests operational discipline that would make legitimate consulting firms jealous. They’re essentially running cybercrime as a business, complete with market research and sector specialization.

The Silver Lining in This Digital Storm Cloud

Before you start booking your next vacation via covered wagon, there’s good news. The targeted airlines have maintained operational continuity—flights are still departing and arriving on schedule. This suggests these organizations have implemented proper network segmentation and business continuity planning.

In cybersecurity terms, this is like having airbags in your car. The crash still hurts, but you’re more likely to walk away from it.

What This Means for Your Organization

If you’re thinking, “Well, I don’t run an airline, so I’m safe,” think again. Scattered Spider’s tactics work across any industry that relies on:

  • Help desk operations
  • Call centers
  • Third-party vendors and contractors
  • Customer service representatives with system access

Sound familiar? That describes roughly 90% of modern businesses.

Practical Defense Strategies
1. Implement Rigorous Identity Verification

Your help desk should treat every caller as if they’re attempting social engineering—because they might be. Multi-factor authentication isn’t just for users; it should extend to support interactions.

2. Conduct Regular Social Engineering Training

Your employees need to understand that the person calling at 3 PM claiming to be “Dave from IT” might actually be “Dave from Cybercrime.” Regular phishing simulations and social engineering awareness training are no longer optional.

3. Establish Network Segmentation

If Scattered Spider gains access, ensure they can’t reach everything. Proper network segmentation means an unauthorized access in your customer service system doesn’t automatically grant threat actors access to your most sensitive data.

4. Strengthen Vendor Risk Management

Remember, these attacks often target IT contractors and trusted vendors. Your security is only as strong as your weakest partner’s defenses.

The Bottom Line

Scattered Spider’s aviation campaign reminds us that sometimes the most sophisticated attacks use the most basic techniques. While we focus on AI-powered threats and advanced persistent threats (APTs), these cybercriminals succeed with nothing more than charm, confidence, and a phone.

The good news? Social engineering attacks are entirely preventable with the right policies, training, and culture. The challenge? They require something often harder to implement than technical solutions: getting humans to consistently follow security protocols.

As we watch Scattered Spider continue their sector-by-sector tour of American business, one thing is clear: the best defense against social engineering combines security awareness with healthy skepticism. In cybersecurity, paranoia isn’t a bug—it’s a feature.

Even Diamonds Aren’t Forever: Cartier’s Latest Data Breach Sparkles for All the Wrong Reasons

June 3, 2025

When you think of Cartier, you probably picture timeless elegance, celebrities dripping in diamonds, and price tags that make your mortgage look like a pocket change. What you probably don’t picture is hackers making off with customer data in a digital heist.

Well, surprise! The luxury giant just disclosed that cybercriminals managed to break into their systems and accessed customer information. While they didn’t steal the crown jewels (literally), this incident serves as another reminder that in cybersecurity, no brand is too prestigious to escape targeting.

What Happened at the Maison Cartier?

According to the company’s notification to affected customers, unauthorized parties gained access to Cartier’s systems and obtained:

  • Customer names
  • Email addresses
  • Countries of residence

The Good News?

No passwords, credit card numbers, or banking information were compromised. While hackers now know you live in Beverly Hills and your email is “DiamondLover2024@gmail.com,” they can’t immediately raid your bank account or access your other accounts.

The key word is immediately.

The Concerning News?

Cartier hasn’t disclosed how many customers were affected or when they first detected the incident. The lack of transparency isn’t exactly reassuring for a brand built on trust and prestige.

A Troubling Trend in Luxury Retail

This incident doesn’t exist in isolation. Just last week, Victoria’s Secret & Co.’s website went offline due to a cyberattack, and Adidas disclosed that hackers accessed customer service data through a third-party provider. It’s become an expensive, very public game of cybersecurity whack-a-mole.

Even more concerning, this follows major attacks on the UK retailers, including the luxury department store Harrods and Marks and Spencer, by the DragonForce ransomware group. The M&S attack alone reportedly threatened with significant financial impact—demonstrating the real cost of inadequate cybersecurity.

Why Luxury Brands Are Prime Targets

From a cybersecurity perspective, luxury brands present particularly attractive targets because they offer:

  • High-value customer bases: Wealthy individuals worth targeting for further attacks
  • Valuable brand reputation: Perfect leverage for ransom demands
  • Global reach: More attack surfaces and entry points
  • Premium customer expectations: Higher reputational damage from incidents

When threat actors target luxury brands, they’re not just after customer data—they’re after prestige and maximum impact potential.

Cartier’s Response: The Good and the Gaps

What they did right:

  • Promptly notified affected customers
  • Engaged external cybersecurity specialists
  • Informed relevant authorities
  • Advised customers to remain vigilant

Where they could improve:

  • No disclosure of the attack vector or timeline
  • No information about the number of impacted customers
  • Limited details about remediation efforts

Transparency in incident response should be like a well-cut diamond—flawless and crystal clear.

The Broader Lesson: Security Must Match Brand Value

Whether you’re selling LOVE bracelets or love t-shirts, the cybersecurity lesson remains constant: threat actors don’t respect brand prestige when planning their next attack.

Protecting Your Business (Regardless of Your Price Point)

  1. Implement multi-layered security – Defense in depth isn’t just for Fortune 500 companies
  2. Conduct regular security assessments – Penetration testing should be as routine as inventory checks
  3. Develop incident response plans – Know what you’ll do before you need to do it
  4. Train your team – Staff are often your first line of defense and your weakest link
  5. Manage third-party risks – See above, Adidas was accessed through a service provider

The Bottom Line

Cartier’s incident starkly reminds us that in today’s threat landscape, every business—from neighborhood boutiques to global luxury empires—needs robust cybersecurity measures. The difference between a minor incident and a company-ending catastrophe often comes down to preparation, detection speed, and response quality.

Your brand’s security posture should be as impeccable as your reputation.

When the Alarm Sounds: C-Suite Decision Frameworks for Cybersecurity Crises

June 16, 2025

A strategic guide for executive leadership during their organization’s most critical hours

The phone rings on a Friday at 2:47 AM. Your CISO’s voice cuts through the silence: “We have a situation.” In that moment, every decision your C-suite makes will reverberate through your organization for years. The difference between companies that emerge stronger from a cyber incident and those that crumble often comes down to one thing: having a tested incident response plan when chaos reigns.

The First Hour: Clarity Through Structure

When adrenaline surges and technical teams scramble, executives need a structured approach. The most successful crisis responses we have witnessed follow what we call the REACT Framework:

  • Recognize the scope and severity
  • Establish command structure
  • Assess legal and regulatory obligations
  • Communicate with precision
  • Take immediate protective action

This framework serves as more than just another acronym—it’s a mental model that prevents the two most dangerous executive behaviors during a crisis: paralysis and premature action.

The Scope Assessment Challenge

Many C-suite members make a critical error in the first hours: they either catastrophize a minor network intrusion or underestimate a major security incident. Success depends on establishing clear escalation criteria before crisis strikes.

Ask these three questions immediately:

  1. What data categories are potentially compromised?
  2. How many individuals could be affected in the worst case scenario?
  3. What regulatory notification timelines are we facing?

The answers to the above questions determine whether you’re managing a contained incident or preparing for a congressional testimony.

Command Structure: Decisive Leadership Under Pressure

Collaborative decision-making serves organizations well during normal operations. During a cyber crisis, committees become liabilities. Designate a single Crisis Commander within your C-suite—typically the CEO or COO—who has ultimate authority over all crisis-related decisions. Everyone else, including other C-suite members, reports through this structure.

This approach prioritizes speed and accountability over consensus. I have witnessed too many organizations paralyzed by competing voices when they needed decisive action the most.

The Legal Balance

Here’s where many executives stumble: they either ignore legal counsel entirely in their rush to “fix things,” or become so overwhelmed by legal considerations that they fail to protect their business interests.

The reality requires balance between the two. Yes, you need legal guidance on privilege protection, notification requirements, and regulatory compliance. However, legal risk represents just one factor in your decision matrix. Sometimes the legally safest path proves business-damaging.

Work with your incident response counsel to understand your options, NOT to delegate your decision-making authority.

Communication: The Reputation-Defining Moment

Your crisis communication strategy will shape your organization’s reputation for the next decade. The cardinal rule: never communicate until you can answer these four questions with confidence:

  1. What happened?
  2. What are we doing about it?
  3. How are we protecting those affected?
  4. How are we preventing future incidents?

Half-truths and premature statements create more damage than temporary silence. However, in our connected digital age, prolonged silence becomes the story itself. Again, balance.

Taking Protective Action: First Steps Matter

Your immediate priority must be containing the incident and protecting your organization. This means implementing emergency response protocols, securing compromised systems, and mobilizing your incident response team. You need to address this step before you can even start to think about recovery and restoration.

Containment as a first step demonstrates leadership and can significantly limit the scope of damage. We have seen organizations minimize the impact of a security incident by hours or even days through a decisive containment.

Beyond the Framework: Building Resilient Leadership

The best C-suite teams don’t merely survive crises—they leverage them as catalysts for organizational improvement. This requires a mindset shift from viewing cybersecurity incidents as pure cost centers or PR disasters to recognizing them as opportunities to strengthen stakeholder relationships and accelerate digital transformation initiatives.

Preparing for the Inevitable

The question isn’t whether your organization will face a cybersecurity crisis—it’s whether your C-suite will be prepared to lead through it effectively. Start building your decision framework today:

  • Conduct tabletop exercises with realistic scenarios, time pressure, and consequences
  • Establish clear escalation criteria and decision authorities
  • Build relationships with IR counsel, PR firms, and forensic investigators before crisis strikes
  • Create communication playbook that can be quickly customized for specific incidents

The Choice Ahead

The next time that phone rings at 2:47 AM, will your organization have the frameworks in place to transform crisis into competitive advantage? The choice is yours to make—preferably before the alarm sounds.