Incident Types: The types of cybersecurity incidents that have occurred include Breach.

Total Financial Loss: The total financial loss from these incidents is estimated to be $0.

Detection and Response: The company detects and responds to cybersecurity incidents through an containment measures with removed hacker access, and communication strategy with notification to employees, and incident response plan activated with likely ad-hoc; most organizations lack playbooks for non-email phishing, and third party assistance with push security (browser-based phishing detection), third party assistance with mdr/soc providers (for containment), third party assistance with linkedin trust & safety team (account takeover reports), and law enforcement notified with unlikely unless fraud/ransomware escalates, and containment measures with blocking known malicious urls (whack-a-mole approach), containment measures with revoking compromised sso tokens, containment measures with disabling synced credentials on personal devices, containment measures with isolating affected executive accounts, and remediation measures with enforcing mfa on all accounts (including personal linkedin), remediation measures with browser isolation for high-risk roles, remediation measures with sso audit & saml configuration hardening, remediation measures with employee training on non-email phishing, remediation measures with monitoring for ghost logins/anomalous sessions, and recovery measures with credential rotation for execs/privileged users, recovery measures with linkedin account recovery (for hijacked profiles), recovery measures with reputation management (customer/partner communications), and communication strategy with internal alerts (avoiding panic but raising awareness), communication strategy with executive-specific warnings (targeted messaging), communication strategy with public disclosure only if regulatory/mandatory, and network segmentation with recommended for high-value targets, and enhanced monitoring with browser-level phishing detection (e.g., push security), enhanced monitoring with behavioral analytics for anomalous logins, enhanced monitoring with dark web monitoring for stolen credentials..

Common Attack Types: The most common types of attacks the company has faced is Breach.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Hijacked LinkedIn Accounts (60% of infostealer logs contain social media credentials)AI-Generated Direct Messages (Scalable Outreach)Fake Investment Opportunity Landing PagesCompromised Personal Devices (Laundering to Corporate Access).

Average Financial Loss: The average financial loss per incident is $0.00.

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Customer Data, Personally Identifiable Information, Health Information, , Names, Social Security Numbers, Health Insurance Details, , Corporate Credentials, Personally Identifiable Information (Pii), Financial Data (If Execs Have Access), Customer/Partner Data (Via Sso), Internal Communications and .

Incident Response Plan: The company's incident response plan is described as Likely ad-hoc; most organizations lack playbooks for non-email phishing.

Third-Party Assistance: The company involves third-party assistance in incident response through Push Security (Browser-Based Phishing Detection), MDR/SOC Providers (for containment), LinkedIn Trust & Safety Team (Account Takeover Reports), .

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Enforcing MFA on All Accounts (Including Personal LinkedIn), Browser Isolation for High-Risk Roles, SSO Audit & SAML Configuration Hardening, Employee Training on Non-Email Phishing, Monitoring for Ghost Logins/Anomalous Sessions, .

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by removed hacker access, blocking known malicious urls (whack-a-mole approach), revoking compromised sso tokens, disabling synced credentials on personal devices, isolating affected executive accounts and .

Data Recovery from Ransomware: The company recovers data encrypted by ransomware through Credential Rotation for Execs/Privileged Users, LinkedIn Account Recovery (for Hijacked Profiles), Reputation Management (Customer/Partner Communications), .

Ensuring Regulatory Compliance: The company ensures compliance with regulatory requirements through Class-Action Lawsuits (if PII exposed), Regulatory Investigations (e.g., SEC for public companies), .

Key Lessons Learned: The key lessons learned from past incidents are Phishing is no longer confined to email; security must extend to all communication channels (social media, messaging apps, etc.).,Personal apps (e.g., LinkedIn) used for work purposes create blind spots for security teams.,MFA gaps on 'personal' accounts (e.g., LinkedIn) can lead to corporate breaches via credential syncing.,Executives are high-value targets due to their access privileges and trust within organizations.,Traditional email security tools are ineffective against non-email phishing vectors.,SSO platforms (e.g., Okta, Microsoft Entra) amplify the impact of single-account compromises.,Browser-level security is critical to detect phishing across all delivery channels.,Proactive measures (e.g., ghost login detection, MFA enforcement) are essential to mitigate risks.

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: California Office of the Attorney GeneralDate Accessed: 2023-11-01, and Source: Push Security: 'Phishing in 2025: Trends and Case Studies' Webinar, and Source: Okta Breach (2023) Post-Mortem: Personal Google Account Compromise, and Source: Infostealer Log Analysis: 60% of Credentials Linked to Social Media (Including LinkedIn).

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Notification to Employees, Internal Alerts (Avoiding Panic But Raising Awareness), Executive-Specific Warnings (Targeted Messaging) and Public Disclosure Only If Regulatory/Mandatory.

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Executives: Avoid Mixing Personal/Professional Accounts; Enable Mfa On Linkedin., It/Security Teams: Monitor For Sso Anomalies And Browser-Based Attacks., Hr: Include Linkedin Phishing In Security Awareness Training., Legal/Compliance: Prepare For Potential Regulatory Scrutiny If Pii Is Exposed., No Direct Customer Advisories Unless A Specific Breach Occurs (General Awareness Recommended)., Customers Should Monitor For Phishing Attempts Impersonating Partnered Executives. and .

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Push Security (Browser-Based Phishing Detection), Mdr/Soc Providers (For Containment), Linkedin Trust & Safety Team (Account Takeover Reports), , Browser-Level Phishing Detection (E.G., Push Security), Behavioral Analytics For Anomalous Logins, Dark Web Monitoring For Stolen Credentials, .

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Immediate: ['Block known malicious domains (though limited effectiveness).', 'Reset credentials for compromised executives/SSO accounts.', 'Isolate affected devices to prevent lateral movement.', 'Report hijacked LinkedIn accounts to LinkedIn Trust & Safety.'], Short Term: ['Deploy browser-level phishing detection (e.g., Push Security).', 'Enforce MFA on all LinkedIn accounts used for work.', 'Audit SSO configurations for over-permissioned roles.', 'Train employees on non-email phishing (LinkedIn, Slack, etc.).', 'Monitor for ghost logins and anomalous sessions.'], Long Term: ["Adopt a **Zero Trust** model for all applications, including 'personal' apps used for work.", 'Implement **unified endpoint management (UEM)** to restrict personal account use on corporate devices.', 'Develop **cross-channel phishing playbooks** (email, social media, SaaS).', 'Conduct **regular red team exercises** simulating LinkedIn-based attacks.', 'Partner with **threat intelligence providers** to track dark web sales of corporate credentials.', 'Advocate for **industry-wide standards** on non-email phishing reporting/mitigation.'], .

Last Attacking Group: The attacking group in the last incident were an Lapsus$ group, Unauthorized Actor and Unauthorized Actor.

Most Recent Incident Detected: The most recent incident detected was on 2023-11-01.

Highest Financial Loss: The highest financial loss from an incident was Potential multi-million-dollar losses per breach (scalable based on executive access).

Most Significant Data Compromised: The most significant data compromised in an incident were Customer Data, Names, Social Security numbers, Health or medical insurance plan numbers, , Names, Social Security numbers, Health insurance details, , Corporate Credentials (SSO, SaaS, Identity Providers), Executive/Employee PII, Internal Communications (Slack, Teams), Customer Data (via compromised tenant access), Financial Records (if execs have approval privileges), Intellectual Property (depending on access level) and .

Most Significant System Affected: The most significant system affected in an incident were Microsoft Entra (Azure AD)Google WorkspaceOkta (or other Identity Providers)Connected SaaS Applications (via SSO)Internal Messaging Platforms (Slack, Teams)Corporate Devices (Laptops, Phones with Synced Credentials)Personal Devices (Laundering for Corporate Access).

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was push security (browser-based phishing detection), mdr/soc providers (for containment), linkedin trust & safety team (account takeover reports), .

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Removed Hacker Access and Blocking Known Malicious URLs (Whack-a-Mole Approach)Revoking Compromised SSO TokensDisabling Synced Credentials on Personal DevicesIsolating Affected Executive Accounts.

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Financial Records (if execs have approval privileges), Names, Social Security numbers, Intellectual Property (depending on access level), Health or medical insurance plan numbers, Corporate Credentials (SSO, SaaS, Identity Providers), Customer Data, Internal Communications (Slack, Teams), Customer Data (via compromised tenant access), Health insurance details and Executive/Employee PII.

Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 839.0.

Highest Fine Imposed: The highest fine imposed for a regulatory violation was Depends on jurisdiction and scale of breach.

Most Significant Legal Action: The most significant legal action taken for a regulatory violation was Class-Action Lawsuits (if PII exposed), Regulatory Investigations (e.g., SEC for public companies), .

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Proactive measures (e.g., ghost login detection, MFA enforcement) are essential to mitigate risks.

Most Recent Source: The most recent source of information about an incident are Infostealer Log Analysis: 60% of Credentials Linked to Social Media (Including LinkedIn), Push Security: 'Phishing in 2025: Trends and Case Studies' Webinar, Okta Breach (2023) Post-Mortem: Personal Google Account Compromise and California Office of the Attorney General.

Current Status of Most Recent Investigation: The current status of the most recent investigation is Investigating.

Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was Executives: Avoid mixing personal/professional accounts; enable MFA on LinkedIn., IT/Security Teams: Monitor for SSO anomalies and browser-based attacks., HR: Include LinkedIn phishing in security awareness training., Legal/Compliance: Prepare for potential regulatory scrutiny if PII is exposed., .

Most Recent Customer Advisory: The most recent customer advisory issued was an No direct customer advisories unless a specific breach occurs (general awareness recommended).Customers should monitor for phishing attempts impersonating partnered executives.

Most Recent Reconnaissance Period: The most recent reconnaissance period for an incident was Short (if using hijacked accounts with existing connections)Longer if building fake profiles from scratch (weeks/months).