Case Studies
Case studies & lessons learned
Real, well-documented incidents explained for GRC work: what happened, the root cause, which controls failed and what to change. Each one links to a hands-on lab and its public sources.
How to run a post-incident reviewA blameless review that finds root causes and produces owned, dated actions.Read the guide2025 in review: breaches and regulationThe incidents and rule changes that shaped GRC work in 2025.Read the reviewMOVEit Transfer mass data theft, 2023A SQL injection zero-day in a file transfer tool let one group steal data from organisations worldwide.Read the caseChange Healthcare ransomware attack, 2024A remote access portal without MFA led to the largest health data breach reported in the US.Read the caseCrowdStrike Falcon update outage, July 2024A faulty security content update crashed about 8.5 million Windows devices. No attacker involved.Read the caseSnowflake customer data thefts, 2024Stolen passwords, no MFA and no network allow lists opened about 165 organisations’ cloud data.Read the caseMarks & Spencer cyber attack, 2025Impersonation through a third party led to ransomware, a 46-day pause in online orders and a £300m profit hit.Read the case
Summaries are written from the cited public sources. Organisations are named only where the facts are public; always check the original source.