Not hypotheticals. Three engagements, written up the way they happened —
what we touched, how long it took, and what was sitting behind the door when it opened.
Every case below is real in pattern and altered in detail.
Names, numbers, locations and dates are changed, and the organisations described are
composites. Client work is never published without written permission. What you are
reading is the shape of the problem, not the client.
CASE 01
Automotive dealer group · 120 staff · Melbourne
Full domain compromise
The OA was the front door, and it was unlocked
An exposed staff portal took us from a login box to domain administrator in under three hours — and from there to every customer record, finance application and stock sheet the group owned.
How it started
The engagement began as it always does: what is visible. The dealer group ran an OA (office automation) portal on a public IP so staff could approve leave and purchase orders from home. It had been there for years. Nobody remembered who owned it.
The chain
Recon and scan — subdomains, then ports. The OA answered on 443 and on a second, unrelated port running an old file-share service.
Entry — the OA login accepted a username that had been in a staff directory leaked three years earlier. No lockout, no MFA.
Upload to execution — the OA's document module allowed an upload with a misleading extension. It executed.
Local privilege escalation — an unpatched service on the host ran as SYSTEM.
Root on the application server — full control of the box the OA lived on.
Lateral movement — cached credentials in memory opened the file server, then the database server.
Data — customer records, finance applications, driver licences, stock and pricing — exported.
What it could have cost
Ransomware. With domain admin, deleting backups before encrypting production is a scripted step, not an achievement.
Identity theft. Driver licences plus addresses plus income data is the exact package used to open credit in someone else's name.
Finance pipeline exposure. Every declined application, every default — visible to anyone who buys the file.
Supplier and pricing leakage. Competitors can see your margin on every model.
Regulatory exposure. Notifiable data breach, with the notification cost falling on the business, not the attacker.
Silent persistence. Without a re-test, nobody knows whether the way in was actually closed.
How it was closed
The OA was moved behind the corporate VPN, the file-share service retired, and the host rebuilt rather than cleaned. Local admin rights were removed from the application service account, and the domain was re-segmented so that a web server can no longer reach a domain controller directly.
Nobody targeted this company. A login page answered, and everything behind it was reachable from the same chair.
CASE 02
Online retail platform · 60 staff · Sydney
Backdoor installed
They came in through the side, and left a key
The shopping front end was fine. The admin panel on a forgotten port was not. By the end, an account existed that could log back in at any time — and nobody would have known.
How it started
This one started with the kind of information any competitor can collect in an afternoon: subdomains from certificate logs, IP ranges, and which services answered on which ports. The storefront was hardened. A second, older management interface was not.
The chain
Collection — certificate transparency gave eleven subdomains, including two that were never linked from the site.
Product data without auth — a product API answered with full inventory, cost price and supplier codes — no session required.
Port sweep — a non-standard port answered with a management console for a five-year-old build.
Credential attack — the console had no lockout. A short, targeted list found the administrator password.
Administrative access — the console could read the customer table and issue refunds.
Lateral — the console held database credentials for the production storefront.
Persistence — a scheduled task and a second account were created. Both survived a password reset.
What it could have cost
Silent return. A backdoor means the breach is not a past event. It is a standing invitation.
Refund fraud. The admin console could issue refunds to any card. That is direct cash, not just data.
Customer phishing at scale. Real order numbers and real addresses make a fake delivery notice almost impossible to spot.
Reputational damage. Retail customers do not distinguish between 'their site was hacked' and 'they sold my data'.
Insurer position. Without evidence of remediation, a cyber policy may decline the claim.
Competitive intelligence. Cost prices and supplier terms are the most commercially valuable thing on the server.
How it was closed
The legacy console was decommissioned rather than patched. Database credentials were rotated and the storefront moved to a separate network segment. The two persistence artefacts were removed and a 30-day verification confirmed nothing returned.
The front door was locked. The side door had not been opened since 2019, and the key was still under the mat.
CASE 03
Warehouse and distribution · 22 staff · Brisbane
Commercial data taken
A small warehouse lost its entire book in one afternoon
A low-cost OA platform, two versions behind, gave away every order, every quote and every customer contact — the three things a distributor actually owns.
How it started
Twenty-two people, one warehouse, one OA system bought cheap five years ago and never updated. It ran purchasing, quoting and delivery scheduling. It also sat on the public internet because the staff worked from two sites.
The chain
Fingerprint — the login page identified the product and version. That version had a published vulnerability with working exploit code.
Upload — the vulnerability allowed an unauthenticated file upload. It executed.
Web shell — a shell on the web server, running as the same account that served the application.
Configuration read — database credentials sat in a plain-text config file one directory up.
Clean-up — the web shell was removed after reading. Nothing was modified, so nothing alerted.
What it could have cost
Your margin is public. Quote history against cost price tells a competitor exactly how you win work — and how to undercut it.
Customer list. For a distributor, the customer list is the business. It does not grow back.
Contract loss before you know it. There is no alert when a competitor quotes your top twenty accounts.
Supply chain trust. If you hold other companies' delivery data, they will ask how it was protected.
No evidence to work from. Read-only access leaves nothing in the logs. You cannot prove what was taken, which makes notification impossible to scope.
How it was closed
The OA was patched, moved behind a VPN, and its database user reduced to the minimum permissions it needed. Credentials were rotated. A one-page change record now exists for every version that goes public.
The cheapest system in the building held the most valuable thing in it.
Find out which one you are.
Twelve checks, no account, no contact. It takes about fifteen seconds and it will
tell you whether you look like case 01, 02 or 03 from the outside.