Findings · 5 of 16

Social engineering beat every technical control

What it is

The largest breaches in this tracker required no zero-day, no malware, and no technical exploit. They were phone calls to help desks.

Why it matters

Security spending does not address this, and neither does choosing a well-resourced company - Cisco, a security vendor, and Microsoft's own Teams were both used as the delivery channel. The attack that keeps working is the oldest one, because help desks are designed to be helpful.

Companies and rows it touches

The 2025-26 ShinyHunters/Salesforce campaign (attackers claimed hundreds of victim organisations, incl. Google and Workday). Aflac (~22.65 MILLION people notified). MGM Resorts. Caesars. Voya (2016 intrusion; Sept 2018 SEC order - the SEC's first Identity Theft Red Flags Rule enforcement, same technique a decade earlier).

Where to look

F500 Tech & Semiconductors (Salesforce master entry); Life-Health-Dental (Aflac); F500 Entertainment & Leisure (MGM, Caesars); Retirement & Telehealth (Voya)