Legacy systems nobody retired
Decommissioned and inherited systems keep live credentials, live keys and live network paths — long after they leave the org chart and the audit scope.
Cybersecurity, briefed for the boardroom
Every major breach entered through a door someone left open.
Breach Brief is a weekly video investigation of the breaches that moved markets — reconstructed as boardroom case files: what happened, what it cost, and the decisions that would have stopped it. Read the brief, watch the case file.
$3.19B
in documented losses across the case files published so far
192.7M
people affected by a single breach — the largest in U.S. healthcare history
10 min
is all one phone call to a helpdesk took to open a $100M incident
The series
The Case Files
Each episode is built from primary sources — SEC filings, congressional testimony, court records — and closed with the questions your board should be asking. Every case file now has a written brief here, alongside the video.
Latest case file
Case File #0003
The Change Healthcare Hack
A legacy remote-access portal with no multi-factor authentication. Stolen credentials. The largest healthcare breach in U.S. history — and a final bill more than double the first estimate.
$3.09Bfinal cost · 192.7M people affected
October 30, 2026
Read the brief →
Latest case file
Case File #0002
The MGM Resort Hack
A sub-ten-minute phone call to an IT helpdesk handed attackers valid credentials inside one of the world's largest casino operations. Caesars paid. MGM didn't.
$100Min losses, nine days of disruption
October 26, 2026
Read the brief →
Case File #0002
The MGM Resort Hack
A sub-ten-minute phone call to an IT helpdesk handed attackers valid credentials inside one of the world's largest casino operations. Caesars paid. MGM didn't.
$100Min losses, nine days of disruption
October 26, 2026
Read the brief →
Case File #0001
The OpenCode Breach
A legacy system being decommissioned still held live AI provider keys. Someone found them — and other people's AI bills started paying for a competitor's training runs.
$1,700charged overnight to a single account
October 23, 2026
Read the brief →
The pattern
Three breaches. Three open doors.
Different industries, different attackers — the same failure pattern. None of them required breaking encryption. All of them required only an access path nobody owned.
The open door
The control that closes it
Retire it, or inventory it
A living inventory of legacy systems and access paths, with an owner and a shutdown date for every one of them.
A helpdesk that couldn't verify identity
If a caller can reset credentials or enrol a new device with charm and publicly available details, your helpdesk is an access broker — not a control.
Verification before reset
A documented identity-proofing protocol for every credential reset and device enrolment. No exceptions for executives, no exceptions for charm.
Remote access without MFA
A single stolen password on a legacy portal was enough to start a $3.09 billion incident. Multi-factor authentication is not a feature. It is the lock.
MFA on every access path
Multi-factor authentication covering 100% of remote access — including the legacy portal everyone forgot. Especially that one.
Questions
Frequently asked
What is Breach Brief?
A weekly video briefing that reconstructs major cyber breaches as boardroom case files — what happened, what it cost, and the decisions that would have prevented it — built entirely from primary sources such as SEC filings, congressional testimony and court records.
Who is it for?
Executives and directors who carry the consequences of a breach: CEOs, CFOs, CISOs and board members. No technical background required — every case is translated into exposure, cost and decisions.
When do new case files publish?
Every Monday and Friday at 7:00 pm (El Salvador time), with short briefings on Tuesdays, Wednesdays and Thursdays. Subscribe on YouTube to get each case file as it drops.
Are the figures in each case file verified?
Yes. Every figure is drawn from the public record — regulatory filings, sworn testimony, court documents — and the sources are cited in each episode's description on YouTube.
Can I suggest a breach for a future case file, or work with you?
Yes — use the contact form below for case suggestions, speaking, consulting and business enquiries. Messages go straight to our inbox.
Contact
Talk to Breach Brief
Business enquiries, speaking and consulting, case suggestions, or a door you think we should look at — send it here.
Prefer email? Write to jandradees@gmail.com
Messages are delivered straight to our inbox. This form is protected by bot traps and submission limits, and nothing you send is stored in a database on this site.