Anatomy of a Breach

Anatomy of a Breach: 2024 Year in Review — Change Healthcare, CrowdStrike, Synnovis, and the Year MFA Could Have Prevented Everything

> series: anatomy_of_a_breach —— part: 192 —— year: 2024 —— verdict: mfa_could_have_prevented_everything<span class="cursor-blink">_</span>_

Hedgehog Security 31 December 2024 16 min read

2024: the year MFA could have prevented everything. And the year a security update crashed the world.

2024 was defined by two themes: the continued, catastrophic consequences of absent MFA, and the systemic fragility of global IT infrastructure. Change Healthcare — processing one-third of US healthcare transactions — was breached through a Citrix portal without MFA (100 million people, $22 million ransom). The Snowflake campaign exposed 700+ million people through cloud accounts without MFA. Microsoft's own executives' emails were read by Russia's SVR through a test account without MFA.

Then, on 19 July, CrowdStrike's faulty update crashed 8.5 million Windows systems — the largest IT outage in history — proving that even the security tools designed to protect us can be the single point of failure that brings everything down. In the UK, Synnovis ransomware cancelled thousands of NHS blood tests and surgeries across London, Transport for London was attacked by a teenager, and Blue Yonder disrupted Morrisons' supply chain. In December, the US Treasury was breached by China's Silk Typhoon through a compromised BeyondTrust vendor account — closing the year with yet another supply chain compromise of a nation's financial infrastructure.


Recommended

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Twelve months. Sixteen years of evidence condensed into one devastating year.

# Breach Key Lesson
181 Microsoft / Midnight Blizzard Russia reads Microsoft executives' email. Test account. No MFA. At Microsoft.
182 LockBit Takedown UK NCA leads Operation Cronos. 1,000+ decryption keys. Most prolific group disrupted.
183 Change Healthcare 100M people. $22M paid. No MFA on Citrix. US healthcare payments halted for weeks.
184 AT&T 73M 2019 breach denied, 2024 data surfaces. Denial delays the reckoning.
185 Snowflake Campaign Ticketmaster 560M, AT&T 110M, Santander 30M. No MFA on cloud accounts. 700M+ affected.
186 Synnovis / NHS London UK: Blood tests cancelled. Surgeries postponed. O-type blood shortage. Patient data published.
187 CrowdStrike Outage 8.5 million systems crashed. Not a breach — a faulty security update. The largest IT outage ever.
188 National Public Data 2.9 billion records from a data broker you never heard of. Company goes bankrupt.
189 Transport for London UK: 9 million daily journeys. 5,000 in-person credential resets. 17-year-old arrested.
190 Internet Archive 31M accounts. The library of the internet. No mission exempts you.
191 Blue Yonder UK: Morrisons, Sainsbury's disrupted. Supply chain vendor ransomware — year four.
192 US Treasury + Year Review China breaches US Treasury via BeyondTrust. Sixteen years complete.

192 articles. 2009 to 2024. The root causes have not changed. The controls have not changed. The choice is yours.

With 192 articles spanning sixteen years, the Anatomy of a Breach series has documented the most comprehensive history of the modern cyber threat landscape ever compiled. From HMRC's lost CDs (2007/2009) to the US Treasury's BeyondTrust compromise (2024). From SQL injection to AI-powered attacks. From £1,000 ICO fines to national emergency declarations. From data on CDs to data in the cloud. From teenage hackers to nation-state cyber warfare.

The attack techniques have evolved continuously. The scale has grown exponentially. The consequences have escalated from inconvenience to existential threat. But the root causes — unpatched systems, absent MFA, misconfigured infrastructure, supply chain trust, social engineering, and the persistent gap between security policy and implementation — remain unchanged from article #001 to article #192. The controls remain the same: penetration testing, Cyber Essentials certification, SOC in a Box monitoring, and incident response capability. Sixteen years of evidence. One conclusion. The organisations that implement these controls survive. The rest fill these pages.


192 breaches. Sixteen years. MFA still prevents the biggest breaches. Patching still matters. Testing still works. Act now.

<a href="/penetration-testing">Test</a>. <a href="/cyber-essentials">Certify</a>. <a href="https://www.socinabox.co.uk">Monitor</a>. <a href="https://www.cyber-defence.io">Prepare</a>. Sixteen years of evidence demands nothing less.

Next Step

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Related Articles