Analysis · Retrospective 2025
tj-actions: fixing the workflow was only the start of secret recovery
The March 2025 compromise connected mutable action tags, secret-bearing logs and credentials that could outlive the malicious code.
Topic
Data Breaches
Analysis · Retrospective 2024
Old credentials opened Snowflake customer accounts
The 2024 Snowflake customer-account campaign followed stolen identities into database access and data export.
Analysis · Retrospective 2024
Change Healthcare made recovery a dependency problem
The 2024 response shows why transaction state and temporary recovery routes belong in continuity planning.
Analysis · Retrospective 2023
MOVEit: patching the transfer server did not settle the data exposure question
The 2023 campaign separated two jobs that incident tickets often collapse: closing the vulnerability and investigating earlier access.
Analysis · Retrospective 2021
ProxyLogon left more to investigate than a patch level
Exchange patch state, earlier exploitation and persistent access need separate evidence in a ProxyLogon response.