Incident Analysis
Cleo MFT CVE-2024-50623 Supply Chain Postmortem
Cleo's managed file transfer products became the next MOVEit. A postmortem on CVE-2024-50623, the Cl0p exploitation, and the file-transfer software risk class.
Apr 15, 20265 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedIncident Analysis
PowerSchool Breach: 62M Students, $2.85M Ransom, Cascading Extortion
PowerSchool's December 2024 breach exposed data on roughly 62M students and 9.5M teachers through a compromised support-portal credential and triggered downstream extortion of school districts months later.
Apr 3, 20266 min read
Incident Analysis
Okta 2023 Customer Support Breach: Implications for Identity Supply Chain
The Okta customer support breach of October 2023 exposed HAR files containing session tokens for major customers. The structural lessons run deeper than the incident.
Apr 3, 20265 min read
Incident Analysis
Patelco Credit Union RansomHub Attack: 1M Records, $7.25M Settlement
RansomHub maintained access to Patelco Credit Union's network from May 23 to June 29, 2024, ultimately exposing data on over one million members and triggering a $7.25M class settlement.
Apr 1, 20266 min read
Incident Analysis
American Water Cyberattack: Largest U.S. Utility Forced Offline
American Water Works discovered unauthorised network access on October 3, 2024, shutting down its MyWater customer portal and billing systems serving 14 million people across 24 states.
Mar 30, 20266 min read
Incident Analysis
Halliburton RansomHub Attack: $35M Loss in Oilfield Services
RansomHub encrypted Halliburton systems on August 21, 2024, exfiltrated proprietary oilfield data, and contributed to a $35M direct response cost disclosed in the company's Q3 10-Q.
Mar 28, 20266 min read
Incident Analysis
SolarWinds Web Help Desk CVE-2024-28987: Hardcoded Credential in Federal Networks
SolarWinds shipped a hardcoded helpdeskIntegrationUser credential in Web Help Desk that CISA added to KEV on October 15, 2024 after federal agency intrusions.
Mar 26, 20265 min read
Incident Analysis
Okta Cross-Tenant Impersonation 2024
Okta's cross-tenant impersonation advisory and related social-engineering campaigns exposed how identity providers get targeted. Lessons for defenders.
Mar 26, 20268 min read
Incident Analysis
MSI Graphics Driver Supply Chain Breach 2023: Lessons
The MSI breach exposed Intel BootGuard private keys and OEM signing infrastructure. A look at firmware-level supply chain risk and the gaps that remain.
Mar 24, 20265 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.