Breach Please

Breach Please Team
  • 0.0 (0)
  • Technology

Cybersecurity has a nonsense problem. Vendors overpromise, headlines overhype, and half the "experts" in your feed have never actually responded to an incident at 3 a.m. Breach Please is the antidote — cybersecurity news, analysis, and unfiltered commentary from two people who have actually done the work: breaking into networks, defending them, and cleaning up after the breaches everyone else only tweets about. Every episode, Jake Williams and Jess Hebenstreit break down the stories that matter, call out the nonsense that doesn't, and translate the never-ending chaos into something you can actually use — whether you're in the SOC, the boardroom, or somewhere pretending to understand both. No fear-mongering. No vendor scripts. No "synergizing our threat posture." Just two seasoned practitioners, the news that matters, and the takes your CISO wishes they could say out loud. Breach? Please. Pull up a chair.

  1. 1d ago

    S0:E27 — The Agentic Ransomware Story That Wasn't

    Palo Alto's Unit 42 published a report describing a fully automated, agentic AI ransomware attack, complete with an 80-page lessons-learned document the attackers supposedly left behind for the victim. It got picked up and ran with by outlets looking for the AI-apocalypse angle. Jess and Jake go through what the report actually says versus what got exaggerated in the retelling, and call out the pattern of vendors using AI-attack framing to sell their own AI-defense product. Second half: a stolen API key with no spending cap burned through hundreds of thousands of dollars in usage before anyone noticed. Jess and Jake use it to talk through exposure management, reachability analysis, and toxic combinations, why chasing CVSS criticals alone is the wrong way to prioritize vulnerability management, and where AI can actually help defenders instead of just generating more hype. In this episode: Unit 42's "agentic ransomware" report: what checks out and what's marketing spinWhy "the threat actor used AI" doesn't mean the defense should be AI-shapedPractical advice for stakeholders asking "how do I defend against AI-driven attacks"Toxic combinations and why prioritizing by CVSS score alone failsA stolen API key with no spending cap and the usage spike that followedExposure management, reachability analysis, and where AI genuinely helps defendersAdam Shostack's updated threat modeling book and his PHANTOM-B threat model framework Show notes: Unit 42 report: https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/The Register coverage: https://www.theregister.com/security/2026/09/02/ai-agents-carried-out-every-step-of-this-ransomware-attack-then-left-the-victim-an-80-page-security-audit/5294009API key incident (The Register): https://www.theregister.com/security/2026/09/01/attacker-stole-a-metr-api-key-used-600k-worth-of-credits-and-no-one-noticed-for-weeks/5293730Threat Modeling, 2nd Edition (preorder): https://www.amazon.com/Threat-Modeling-Designing-Adam-Shostack/dp/1394413327PHANTOM-B whitepaper: https://shostack.org/files/papers/PHANTOM-B_Whitepaper_Shostack.pdf Breach Please is a production of JWJH Media LLC. The opinions of our hosts are their own. Nothing in this episode is legal, financial, or security advice. Do your homework before pointing anything we said at prod.

  2. 2d ago

    S0:E26. IDScan.net suspected data breach, toxic data, and TPRM in general.

    In this episode of Breach Please, Jake and Jess talk about the suspected IDScan.net breach. We discuss whether a situation like this is a data breach for your org if you "only" use a third party processor to verify identity. We decide this is a question best left for external counsel (with the cover of their malpractice insurance). We discuss the difficulties of saying "third party risk management will fix this" and challenge snake oil vendors not to use that line. Finally, we discuss how we might change architecture of our applications in the future. Source article: https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/

  3. 3d ago

    S0:E25 — The Exchange Bug That's Worse Than Its Score

    A CVSS 8 elevation-of-privilege bug in on-prem Exchange looks unassuming until you dig into what it actually grants an attacker. Jess and Jake break down the proxy flaw, why "authorized attacker" is doing a lot of quiet work in that description, and why this is one of the rare moments defenders get a head start before exploitation goes wide. Jake's course at Wild West Hackin' Fest: https://www.antisyphontraining.com/product/hands-on-ai-security-risk-assessment-with-jake-williams/

  4. 5d ago

    S0:E24. We talk about the attack on Boston Scientific and ransomware in general.

    In this episode, Jake and Jess talk about the IT availability issue occurring at Boston Scientific (be real, it's almost certainly ransomware). Then we talk about ransomware response, immutable backups (and specifically what they DON'T get you), and rabbit hole in the ransomware discussion several times. Jake also reps #SAINTCON - you should go if you get the opportunity (tickets for this year are sold out, but you can get on the standby list). https://saintcon.org/ Speaking of conferences, Wild West Hackin' Fest is about a month away and Jake still has a few in-person seats left in his class (expected to sell out this week or next) and unlimited seats in his virtual training. You'll leave after two days ready to perform AI Risk Assessments. https://www.antisyphontraining.com/product/hands-on-ai-security-risk-assessment-with-jake-williams/

  5. Aug 28

    S0E23. The LA County Museum of Art breach that took a year to unravel

    LACMA’s year-long breach disclosure delay and what it says about incident responseJess Hebenstreit and Jake Williams break down a Los Angeles County Museum of Art data security incident that raises big questions about breach timelines, notification delays, and response ownership. They focus on what the disclosure says, what it leaves unsaid, and why the cleanup process may have taken far longer than it should have. In this episode, they examine the gap between initial detection, timeline validation, data review, and eventual notification. They also unpack why the kind of data exposed suggests employee and benefits records, and why that matters for both legal exposure and response logistics. Key topicsThe breach timeline looks unusually longJess and Jake note that LACMA says it detected suspicious activity on July 11, 2025, but did not publish the disclosure until August 24, 2026.They question how it took weeks to confirm the intrusion window and then months more to complete the data review. The delay in scoping the incident raises red flagsJake points out that the investigation later narrowed the third party’s access to July 7 through July 11.They discuss how incident teams can get stuck chasing false leads in logs, but still say this timeline feels slow. Data review appears to have dragged onThe disclosure says the initial data review results arrived in late February 2026.Jess and Jake interpret that as a sign of weak data governance, poor vendor management, or both. The affected data suggests employee and benefits recordsThe potentially exposed data includes full names, dates of birth, Social Security numbers, government ID numbers, financial account numbers, payment card data, health insurance information, and limited medical details.Jess argues that this pattern looks like employee data, possibly tied to a self-funded health plan. Notification logistics seem inconsistentJake questions why the organization spent months trying to obtain “accurate contact information” before notifying impacted people.He notes that breach notification rules generally do not wait for perfect contact data before state reporting obligations begin. A class action lawsuit seems likelyJess says she expects litigation, and Jake agrees.They also suggest state attorney general investigations are likely. The response may have suffered from leadership turnoverJess thinks a change in leadership or responsibility may have disrupted the response.Jake agrees that handoffs, missing context, or people being removed mid-incident can create major problems. They believe outsourcing the data review was the right move, but too lateJake explains why identifying impacted records is harder than it sounds, especially with inconsistent name formats, spellings, and duplicate records.Both agree this kind of work should be handled by a firm that does breach review every day. Cyber insurance and breach counsel likely shaped the responseThey debate whether the organization had cyber insurance and how that would have affected the handling of the case.Jake explains that cyber claims usually involve upfront costs and reimbursement later, which can slow response work. The human cost of a broken incident responseJess closes by saying she feels bad for the responders who had to deal with the mess.Jake advises responders to keep notes, assume they may be deposed later, and remember that the organization will not protect them in enforcement actions. Timestamps00:00 - Breach Please intro and the show’s no-nonsense mission 01:33 - LACMA data security incident enters the conversation 01:50 - Why the disclosure timeline is so hard to believe 03:18 - What the timeline says about detection and scoping 06:01 - Late February 2026 data review results 07:57 - Why “accurate contact information” is a weak explanation 08:52 - Why a lawsuit and state investigations seem likely 09:27 - The exposed data and why it looks like employee records 10:54 - A Reddit post suggesting notifications were already going out 12:12 - Possible leadership change during the response 13:37 - When even counsel decides the incident is too messy 15:31 - Whether cyber insurance was involved at all 17:04 - How cyber claims actually get paid 18:38 - Procurement problems or failed in-house review? 20:21 - Why identifying impacted people is much harder than it sounds 22:36 - Why outsourcing the review was probably necessary 23:35 - Why state reporting obligations still matter even if mailing is slow 24:04 - Sympathy for the responders caught in the middle 25:02 - Why responders should document everything now 25:57 - Final reminder: organizations do not protect employees in enforcement actions 26:11 - Outro and closing sign-off

  6. Aug 27

    S0:E22. We go a little long discussing the OpenAI post-mortem on Hugging Face.

    In today's episode of Breach Please, Jake and Jess talk through the OpenAI post-mortem on the Hugging Face hack. It's a doozy. There's little doubt in either of our minds that the facts as presented don't exonerate OpenAI - they make it look far worse. We cut through the hype and conclude that there's no way OpenAI was following even the most basic of security best practices, even accounting for hindsight bias. Jake closes by reading a passage from one of Sam Altman's tweets from December 2025, which made clear he knew the dangers of AI - the kind of thing that is likely to haunt him in the future. https://openai.com/index/hugging-face-incident-and-the-road-ahead/ https://x.com/sama/status/2004939524216910323

  7. Aug 26

    S0E21: Alabama Comes for OpenAI, WebLogic Comes for Everyone

    Fifteen state attorneys general, led by Alabama, just subpoenaed OpenAI over the Hugging Face breach, demanding the company preserve all evidence related to the intrusion. Jess and Jake break down what that legal hold actually requires, why "mark it ACP" doesn't make a Slack channel privileged, and why the discovery list's question about internal safety concerns might be the part that burns OpenAI hardest. Then: a perfect-10 WebLogic vulnerability, patched back in January, just landed on CISA's Known Exploited Vulnerabilities list, eight months after active exploitation began. Jess and Jake talk through why "patch applied" isn't the finish line and what a post-patch threat hunt should actually look like. In this episode: Fifteen states subpoena OpenAI over the Hugging Face hack and order evidence preservation What a legal hold actually requires (and what evidence spoliation means) Why marking a channel "ACP" doesn't make it attorney-client privileged The discovery request digging into internal safety concerns and model testing A perfect-10 WebLogic CVE, patched in January, added to CISA's KEV eight months later Why "patch applied" doesn't mean "threat hunt done"

  8. Aug 25

    S0:E20 Multi-Agent AI Systems Turn Into Turf Wars

    AI just became a cybersecurity governance problem in public. Jess Hebenstreit and Jake Williams break down Anthropic’s multi-agent research, where AI agents with conflicting goals start negotiating, forcing, or trucing their way through “collaboration.”What does it mean when one model settles by force and another settles by truce? Jess and Jake unpack what that means for real-world agent deployments, human-in-the-loop approvals, and the danger of letting “AI says so” become the final word. You’ll learn why multi-agent systems can spiral into turf wars, why governance gets harder once agents are involved, and how to build controls that still let humans say no.

See All (28)

About

Cybersecurity has a nonsense problem. Vendors overpromise, headlines overhype, and half the "experts" in your feed have never actually responded to an incident at 3 a.m. Breach Please is the antidote — cybersecurity news, analysis, and unfiltered commentary from two people who have actually done the work: breaking into networks, defending them, and cleaning up after the breaches everyone else only tweets about. Every episode, Jake Williams and Jess Hebenstreit break down the stories that matter, call out the nonsense that doesn't, and translate the never-ending chaos into something you can actually use — whether you're in the SOC, the boardroom, or somewhere pretending to understand both. No fear-mongering. No vendor scripts. No "synergizing our threat posture." Just two seasoned practitioners, the news that matters, and the takes your CISO wishes they could say out loud. Breach? Please. Pull up a chair.

Information

  • Creator
    Breach Please Team
  • Years Active
    2026
  • Episodes
    28
  • Rating
    Explicit
  • Copyright
    © Copyright JWJH Meida LLC
  • Show Website
    Breach Please