A mid-sized technology company with a fully remote workforce suffered a phishing-based data breach after an employee accessed a malicious link via an unsecured home Wi-Fi network. The attack exploited weak password practices and lack of multi-factor authentication (MFA) on a shared project management tool containing client lists, financial projections, and patent drafts. The breach went undetected for 12 days, during which attackers exfiltrated employee PII (including National Insurance numbers, bank statements, and self-assessment tax details) alongside customer contact databases. While no ransomware was deployed, the leaked employee data was later sold on dark web forums, and fraudulent activity targeting clients was reported via spoofed emails. The incident triggered regulatory scrutiny under GDPR, leading to fines, and caused reputational harm after a regional business journal published details of the breach. The company’s stock price dipped temporarily, and several high-profile clients terminated contracts citing security concerns. Internal investigations revealed that endpoint protection software was outdated on 30% of remote devices, and no zero-trust architecture was in place.