Five Breaches.
One Answer.
The most damaging cyberattacks of the past two years had different targets, different attackers, and different industries. They shared the same root causes — and the same solution.
Change Healthcare
The ALPHV/BlackCat ransomware group infiltrated Change Healthcare — a processor of 15 billion healthcare transactions annually. After establishing a foothold, they moved laterally across the network, encrypting critical data and locking out clinical systems nationwide.
The attack compromised sensitive data for over 100 million individuals: medical records, prescriptions, and billing information. Change Healthcare ultimately paid a $22 million ransom — while pharmacies across America couldn't process prescriptions for weeks.
Salt Typhoon
Chinese state-backed hackers penetrated at least eight major U.S. telecoms — AT&T, Verizon, T-Mobile, and Lumen Technologies among them. For months they operated silently inside carrier infrastructure, siphoning call metadata, geolocation data, and audio recordings.
The Senate Intelligence Committee chair called it "the worst telecom hack in our nation's history." The attackers weren't loud — they were invisible, persistent, and patient.
Ivanti VPN Zero-Days
Attackers exploited critical zero-day vulnerabilities in Ivanti's Connect Secure VPN — including an authentication bypass flaw. Emergency alerts went out worldwide as organisations scrambled to patch infrastructure they depended on for remote access.
The deeper problem: organisations had built their entire security perimeter around VPN technology. When the VPN collapsed, so did everything behind it.
U.S. Treasury / BeyondTrust
Chinese hackers exploited vulnerabilities in BeyondTrust's remote support software — a trusted third-party tool with privileged access to Treasury workstations. Using the vendor's own API keys as a master key, they accessed documents linked to senior officials.
Treasury declared it a "major cybersecurity incident." BeyondTrust first detected the intrusion December 2nd and only confirmed the breach six days later.
Jaguar Land Rover
A collective combining Scattered Spider, Lapsus$, and ShinyHunters brought Britain's largest automotive manufacturer to its knees via a targeted vishing campaign — stolen credentials opened JLR's network, and weak segmentation did the rest.
All three UK plants halted for five weeks. UK car production fell 27% — the worst since 1952. The Bank of England cited the attack as a factor in slower GDP growth.
The hallway is.
Every attack in this report succeeded the same way: a single entry point became a highway. Attackers didn't need to break every control — they needed one gap nobody was watching, then moved freely from there.
Threatmatic's Zero Trust architecture treats that hallway as the battlefield. Microsegmentation eliminates lateral movement. Continuous identity mapping closes the gap between intrusion and detection. And when a threat is identified, containment fires in under 50 milliseconds — before damage can cascade.
Five incidents. Five root causes. One platform that addresses all of them — replacing the fragmented stack of VPNs, firewalls, and cloud gateways that failed each of these organisations with a single, lightweight agent built for the threat landscape we actually face.
