NYC Health + Hospitals disclosed a months-long breach exposing biometric, medical, and financial data for 1.8 million people through a third-party vendor. Two-thirds of the dataset can be rotated. The rest cannot. The remediation playbook the industry inherited from the credit-card era does not bend to fit data that is permanent by nature.
We didn’t ship a redesign. We shipped a new contract with our users โ a patented OSINT engine, a scenario library that mirrors real attacker workflows, and training that activates the moment someone takes the bait. Here’s what’s new.
At the Tuscany Lightning Summit 2026 in Viareggio, our CTO Francesco Baccaro stood in front of some of the most paranoid engineers in the Bitcoin ecosystem and told them their cryptography wasn’t the problem. The $1.46B Bybit heist, the rise of Permit and EIP-7702 phishing, and a hard truth the crypto industry keeps ignoring.
Two breaches. Eight months. Same group. ShinyHunters tore through Instructure again: 3.65 TB, 275 million records, 9,000 institutions. Device Code Flow plus a phone call. Passkeys don’t help. Here’s the playbook and the defenses.
[email protected] sent the phishing email. DKIM, SPF, DMARC all green. The attacker never spoofed anything โ they got Robinhood to deliver the payload for them. Here is the chain, the code, and why your awareness training is now obsolete.
A โฌ5 gadget. A postcard. 24 hours of real-time tracking on a โฌ500 million NATO frigate. The trust model wasn’t hacked โ it was never there. Full technical breakdown and defensive tools inside.
Between December 2025 and February 2026, one attacker breached nine Mexican government organizations using a dual-AI workflow: Claude Code for live exploitation, GPT-4.1 for post-exploitation reconnaissance at scale. 75% of remote command execution was AI-generated. RCE on a federal server in 40 minutes. This is the PacketHunters breakdown, including defensive scripts and what the forgery system built afterward means for your incident response assumptions.
Mandiant’s M-Trends 2025 confirms it. Voice phishing surged. Email phishing collapsed. Your stack is not the problem. The person who picked up the phone is. And nobody tested them.
Smart contract exploits are declining. Human-layer attacks are not. In 2025, phishing led all crypto attack categories by incident count. We reconstructed three anonymized breach patterns (an exchange, a DeFi protocol, a Web3 startup) and built detection scripts around the OSINT surface each one exposed before the attack landed.
Your job postings just told an attacker which VPN you run. Your engineers’ LinkedIn certs identified your EDR. Certificate transparency logs exposed your internal subdomains. This is the recon phase โ and it happens entirely before anyone touches your network.
