It’s Halloween week, so we’re telling a few scary stories. These aren’t about ghosts or ghouls. They’re composite scenarios based on the kinds of incidents security teams deal with regularly. The details are changed, but the lessons are real.
The invoice that came back from the dead
A finance assistant receives an email from a long-standing supplier. The tone is familiar, the invoice looks right, and there’s a short note: “We’ve changed banks, please update our details.” The payment goes out. Weeks later, the real supplier chases an unpaid invoice.
The supplier’s email account had been compromised. The attacker simply waited for the right moment to step into a real conversation.
The lesson: Always verify changes to payment details by calling a number you already hold, never one provided in the email.
The account that never died
An employee left the business two years ago. Their account was never fully disabled. One day, an attacker logs in with an old, leaked password, and nobody notices because the account isn’t monitored.
The lesson: Run a proper leavers process, review accounts regularly and enforce multi-factor authentication on everything.
The backup that wasn’t there
Ransomware strikes on a Saturday night. On Monday, the team turns confidently to its backups, only to discover they were connected to the network and have been encrypted too. Or that they haven’t run properly for months.
The lesson: Keep at least one backup copy offline or immutable, and test restores regularly. A backup you haven’t tested is only a hope.
The midnight login
At 2am, someone logs into a director’s account from an unfamiliar country. Then they set up a mailbox rule to hide replies from the bank. By the time anyone looks on Monday, the damage is done.
The lesson: Attackers don’t keep office hours. Round-the-clock monitoring with the ability to respond quickly turns a weekend disaster into a contained alert.
The phantom cloud bucket
A developer sets up cloud storage for a quick project and leaves it publicly accessible “just for now”. It’s forgotten. Months later, it turns up in a security researcher’s report, along with the customer data inside.
The lesson: Regularly review cloud configurations and keep an inventory of what you have exposed to the internet.
The call from the boss
A member of the finance team gets a call. It sounds exactly like the managing director, who is travelling and needs an urgent payment made. The voice was cloned from online videos.
The lesson: Agree verification steps for urgent requests, such as a call-back or a code word, so nobody has to rely on recognising a voice.
Turning horror stories into lessons
Stories like these are a powerful training tool, because people remember them far longer than a list of rules. Consider using them in your own organisation:
- Team meetings: spend five minutes on one scenario and ask, “Could this happen here? What would stop it?”
- Induction: share two or three short stories with new starters to show why verification and reporting matter.
- Tabletop exercises: use a scenario as the starting point for a deeper discussion with IT, finance and leadership.
- Internal newsletters: a regular “near miss of the month”, anonymised and blame-free, keeps security visible.
The most useful stories are often your own. Encourage staff to share the suspicious emails, calls and messages they receive, and the near misses they spotted. Each one is a chance for everyone else to learn, without anyone having to experience the real thing.
Keep the tone constructive. The goal isn’t to frighten people, but to show that small, simple habits, like pausing before acting and checking through a trusted channel, stop most attacks in their tracks.
Don’t let it happen to you
None of these stories needed sophisticated hacking. Each one exploited a gap in process, visibility or preparation, and each one is preventable.
CyberQ’s Emergency Readiness & Response helps you close those gaps before they become your horror story, and supports you quickly if the worst happens. Get in touch for a less frightening year ahead.
