On August 22, 2026, an employee at ReliaQuest, a cybersecurity firm, received a phone call from someone claiming to be a named member of the company’s own security team. The caller directed the employee to authenticate through what appeared to be the company’s single sign-on portal. The employee did. The site was a fake, the […]
Social Engineering Defence in the Age of Vishing Read More »
A phishing campaign that has been quietly running for at least five months just exposed a hard truth about employee training programs. When threat researchers at CTM360 published their RecruitTrap findings in August 2026, they mapped more than 3,000 phishing URLs impersonating recruiters from over 50 real organizations. The primary victims were marketing professionals, and
The Phishing Simulation Your Marketing Team Is Missing Read More »
In January 2026, attackers gained access to the personal and financial records of 889 Starbucks employees without ever penetrating the company’s core infrastructure. The method was precise: a convincing replica of Starbucks’ Partner Central, the internal portal workers use to manage payroll, benefits, and employment details, was built to harvest credentials. Workers who entered their
Behaviour Change Cybersecurity: The Starbucks Portal Lesson Read More »
On August 10, 2026, CISA, the FBI, the National Security Agency, and South Korea’s National Police Agency issued a joint advisory warning organizations worldwide about Gunra ransomware, a fast-growing criminal operation that has already claimed Canadian victims. Advisory AA26-222A names healthcare providers, nonprofit services, financial institutions, and government agencies as active targets and describes an
Ransomware Awareness Training: Gunra Targets Nonprofits Read More »
The message from Black Hat USA 2026, which concluded in Las Vegas on August 7, was directed squarely at organizations still running annual click-training programs: the attackers have moved on, and so must you. Researchers documented a threat landscape in which AI tools produce flawless phishing emails at 95 percent lower cost than manual campaigns,
Behaviour Change Cybersecurity: 4 Lessons from Black Hat Read More »
The staff at the UK Department for Education did not hand attackers a password. They answered a help desk request, clicked a link, and responded to what looked like a legitimate internal process. On July 30, 2026, a threat group calling itself ExfilSquad confirmed they had used exactly that approach to steal 607,000 records from
Security Awareness for Schools: A Social Engineering Lesson Read More »
Canadian organizations are paying an average of CA$7.11 million every time a data breach occurs, according to IBM’s 2026 Cost of a Data Breach Report released July 29. That figure is the highest ever recorded since IBM began tracking breach costs in Canada, and it should prompt every security leader in the country to ask
Security Awareness Metrics: Canada’s $7M Breach Cost Read More »
Law enforcement took down Kratos. But the 1,800 criminal subscribers who paid for that phishing-as-a-service platform still have the kit code, and security researchers confirm they are already adapting it. For Canadian finance teams and executives, the practical question is not whether criminals will continue using these techniques; it is whether your organization is ready
When Business Email Compromise Survives the Takedown Read More »
The phone rings at a Canadian IT help desk. The caller identifies themselves as someone from the security team, explains that an account is about to be locked out, and asks the agent to quickly reset the user’s MFA credentials. The call is convincing, the urgency feels real, and the agent has been trained to
Vishing Awareness: Canada’s IT Help Desks Under Attack Read More »
The clients of the Centre for Newcomers came to Calgary for a fresh start. On July 17, 2026, they got something else: their personal records, immigration files, and sensitive status documents became part of a 380 GB haul claimed by the Interlock ransomware group. The organisation, a Calgary-based nonprofit providing immigration and settlement services across
Security Awareness for Nonprofits: The Interlock Problem Read More »
