12 cases. Each names what happened, the source, and the standard that already existed when it happened.

• Equifax, 2017. The patch was published on 7 March. The attack landed on 10 March. 147 million people. FTCInstead: patch on a deadline driven by what is being exploited, not by severity score. CISA publishes the Known Exploited Vulnerabilities catalogue and, under BOD 22-01, gives federal agencies a fixed clock to fix them.
• Capital One, 2019. Regulators found it moved major systems to the cloud without effective risk assessment, then failed to fix the gaps in time. $80 million. OCCInstead: assess the risk before the migration, not after the incident. The standard the OCC measured against is public: 12 CFR Part 30, Appendix B.
• Marriott / Starwood, 2018. An intrusion in Starwood's reservation system went undetected from 2014 until 2018, spanning the acquisition by Marriott. Around 339 million guest records were exposed, including passport numbers. ICO penalty, Marriott data breachInstead: do security due diligence before you buy the company, and monitor what you acquired. The ICO's finding was that Marriott failed to undertake sufficient due diligence.
• SolarWinds, 2020. An attacker compromised the Orion build pipeline and shipped signed, trojanised updates to around eighteen thousand customers. The intrusion ran for months across US federal agencies and Fortune 500 companies. CISA emergency directive 21-01Instead: treat the build system as production and verify what it emits. Reproducible builds and signed provenance were established practice; the SEC's later complaint alleged the internal security posture was known to be far weaker than stated publicly.
• Log4Shell, 2021. A remote code execution flaw in Log4j, present since 2013, became trivially exploitable worldwide. Most of the damage was not the vulnerability but that organisations could not answer whether they were running it. CISA guidanceInstead: keep a software bill of materials. You cannot patch an inventory you do not have, and SBOM practice was formalised before this by the NTIA.
• Colonial Pipeline, 2021. Ransomware entered through a legacy VPN account that was still active and had no multi-factor authentication. The company halted fuel delivery to much of the US east coast and paid roughly 4.4 million dollars. CISA advisory AA21-131AInstead: enumerate and disable dormant credentials, and require MFA on every remote path. Both were long-standing requirements, including in the CIS Controls.
• Optus, 2022. An API endpoint exposed to the internet required no authentication and returned customer records to anyone who asked. Around 9.5 million Australians had identity data taken. OAIC proceedingsInstead: authenticate every endpoint, and test that assumption from outside your network. Broken access control has topped the OWASP Top Ten since 2021 and appeared on it long before.
• MOVEit, 2023. A SQL injection flaw in a widely used managed file transfer product was exploited at scale, reaching thousands of organisations through their vendors rather than directly. CISA advisory AA23-158AInstead: parameterise queries, and know which of your suppliers hold your data. SQL injection has been the canonical, solved web vulnerability for over twenty years.
• Heartbleed, 2014. A missing bounds check in OpenSSL's heartbeat extension let any client read up to 64 kilobytes of server memory, repeatedly and without trace. It had been in shipping code for two years and affected a large share of the public internet. CVE-2014-0160Instead: bounds-check every length field that arrives from the network. This is the most basic rule in parsing untrusted input, and the fix was two lines.
• Mossack Fonseca, 2016. The law firm at the centre of the Panama Papers was running years-old versions of Drupal and WordPress with known, published vulnerabilities, while holding the confidential records of clients worldwide. Panama PapersInstead: patch the public-facing CMS. If you cannot maintain it, do not run it in front of the most sensitive data you hold.
• British Airways, 2018. Attackers injected twenty-two lines of skimming script into a payment page and harvested around 380,000 card details over two weeks without detection. ICO penalty, BA Magecart breachInstead: subresource integrity and a content security policy on payment pages, plus file integrity monitoring. All three were established practice and the ICO said so.
• 23andMe, 2023. Attackers reused credentials leaked from other breaches to access accounts, then pivoted through an opt-in relatives feature to reach data on roughly 6.9 million people who had not been compromised themselves. 23andMe data breachInstead: require MFA on accounts holding genetic data, and treat any feature that fans out from one account to millions as a breach amplifier at design time.