It only takes one person, and it could be any of us

Last Sunday, Nvidia's board put out a short statement saying it had opened an independent investigation after reports that its founder and chief executive, Jensen Huang, "has been the target of a foreign intelligence effort." By Monday the jokes were everywhere, and I understand the temptation. I'd still rather slow down and ask what the rest of us can learn from it.

This week I made an infographic for LinkedIn called "It only takes one person." It packs a lot into one image, so this post is the longer version. I want to walk through where each number comes from, what we know about each incident on it, and where the evidence is thinner than a tidy bar chart makes it look.

Social engineering is a trust problem

Social engineering is the name security people give to attacks that work on people rather than on machines. Instead of hunting for a software bug, the attacker persuades someone to reset a password, share a file, approve a payment or accept a connection request, and they manage it by seeming trustworthy.

People have been falling for this since the Greeks left a wooden horse outside the gates of Troy. What changes is the toolkit. These days the horse might be a job candidate using artificial intelligence (AI) to get through a video interview. Security researchers have documented North Korean information technology (IT) workers using AI-written job applications and real-time deepfake video to get hired by Western companies, as The Record reported. The trick itself hasn't moved an inch, because the attacker still earns trust first and spends it later.

I argued earlier this year that AI makes the security fundamentals matter more, not less. Social engineering is the clearest example I know of. No amount of clever technology helps if the person holding the keys can be talked into handing them over.

Where the headline numbers come from

The 62% in the top corner comes from Verizon's 2026 Data Breach Investigations Report (DBIR), which is about as close as the security industry gets to an annual census. This year's edition looked at more than 22,000 confirmed breaches across 145 countries and found the human element in 62% of them. Verizon defines that broadly. It covers mistakes, misuse of access, stolen passwords and social engineering, so it means a lot more than someone clicking a bad link. The figure has stayed at or above 60% across the last four editions, which tells me this isn't a blip that the next product launch will fix.

The #1 tile comes from IBM's Cost of a Data Breach Report 2026. For the fourth year running, phishing was the most common way attackers first got into the organisations IBM studied. The detail I find more striking sits underneath that headline. Voice and text-message phishing produced the highest average breach cost of any starting point, at $5.29 million, according to eSecurity Planet's summary. A phone call feels more personal than an email, and that is exactly why it works.

The 1 in 3 figure comes from KnowBe4's 2026 Phishing by Industry Benchmarking Report, which draws on 42 million simulated phishing tests sent to 14.8 million people. Before any training, 33.2% of employees fell for the test. After 90 days of training that dropped to 20.1%, and after a year of ongoing training it dropped to 4.2%, which works out to roughly 1 in 24 (KnowBe4's announcement has the headline figures). KnowBe4 sells security awareness training, so these are a vendor's numbers about its own customers, and I'd read them with that in mind. Even so, the sample is huge and the direction of travel is hard to argue with.

The +40% tile needs the biggest caveat. In phishing simulations, Verizon found that lures sent by phone call or text message got a median click rate of about 2%, compared with 1.4% for email, which is a 40% jump (TechTarget covers it here). Verizon is open about the fact that its voice and text sample was small, because so few companies run those simulations, and Keepnet, which contributed the data, explains the numbers in more detail. I think that gap is a finding in its own right. Most of us practise spotting dodgy emails, and almost nobody practises hanging up on a friendly, convincing caller.

Four companies, four ways in

The middle of the infographic ranks four incidents by what they cost. I picked them because each one started with a person rather than a software flaw, and because the costs are public. They aren't all equally well documented, though, so I've tried to be clear about how confident we can be in each.

Marks & Spencer, 2025

Over the Easter weekend in April 2025, attackers got into the systems of Marks & Spencer (M&S), the British retailer. Online orders stopped for weeks and some shelves sat empty. M&S later said the attack would knock around £300 million off its operating profit before insurance, which is roughly $400 million.

The way in wasn't a clever exploit. Chairman Archie Norman told a parliamentary committee that the attackers got in through sophisticated impersonation involving a third party, and the company blamed human error at a contractor, exploited through social engineering (Reuters, via AOL). Reporting at the time, first from BleepingComputer, said the attackers pretended to be M&S employees and persuaded an outsourced IT help desk to reset their passwords (Business Insurance picked it up). M&S hasn't published every detail, so the exact script of that conversation remains private.

Clorox, 2023

In August 2023, an attack on Clorox, the American company behind the bleach of the same name, left it struggling to get products onto store shelves for weeks. Two years later, Clorox sued Cognizant, the IT services firm that ran its help desk, for $380 million (CSO Online).

The lawsuit makes for uncomfortable reading. Clorox alleges that an attacker simply phoned the help desk, said they couldn't log in, and an agent handed over a password without checking who was on the line. The complaint includes call transcripts and says agents also reset multi-factor authentication (MFA), the extra login step that's supposed to stop exactly this, without verifying the caller (The Register). Clorox says it had a procedure for checking callers and that the agents didn't follow it.

The $380 million is a claim in a lawsuit, not a court finding. Cognizant disputes it and says it was hired for a narrow set of help desk services, which it performed reasonably, and that it never ran Clorox's cybersecurity. That's why the infographic says "alleged," and I'd keep that word there until a court says otherwise.

Coinbase, 2025

Coinbase is the case that sits closest to the Nvidia story, because nobody hacked anything. In May 2025, the cryptocurrency exchange disclosed that criminals had bribed some of its overseas customer support agents to pull customer data out of internal tools. The data of 69,461 customers leaked, including names, addresses and images of government identity documents, and the criminals then demanded $20 million to keep quiet (SecurityWeek).

Coinbase refused to pay, fired the agents involved and offered a $20 million reward for information leading to the attackers' arrest instead. In a regulatory filing it put the likely cost at between $180 million and $400 million, mostly to reimburse customers whom scammers later tricked using the stolen details (Engadget).

What makes this one so instructive is that the agents used access they had legitimately been given. To the system, a support agent looking up customer records looks exactly like a support agent doing their job. The lever was money rather than friendship, but the principle holds, because the attackers went after the people who already had the keys.

MGM Resorts, 2023

In September 2023, an attack crippled MGM Resorts' hotels and casinos in Las Vegas. Guests had trouble with room keys, reservations and casino games for more than a week. A few weeks later MGM estimated a hit of about $100 million to a key earnings measure for its properties, plus under $10 million in one-off costs, and said it expected its cyber insurance to cover the damage (TechTarget).

The story everyone repeats about MGM is that the attackers found an employee on LinkedIn, rang the IT help desk pretending to be that person, and walked away with access after a ten-minute call. That version comes from the attackers themselves, relayed through the malware research group vx-underground (SecurityWeek). MGM never confirmed it in its filings, which is why the infographic says "reportedly." It matches the group's other attacks closely enough that I find it believable, but it's still the criminals' own account of what they did.

The pattern across all four

Line them up and the pattern jumps out. Three of the four came in through contractors or outsourced support staff, and every one of them ran through people whose job is to help. Verizon's report backs this up from another direction, finding that 48% of breaches involved a third party in some way, up from 30% a year earlier (eSecurity Planet). Most of us spend far more effort securing our own staff than the people we've handed our keys to.

How these attacks unfold

The bottom of the infographic boils these stories down to four steps. Once you see them, you'll start noticing them everywhere.

It starts with research. The attacker looks for someone with the access they want, and professional networking sites make that very easy. Back in 2022, the head of MI5, Britain's domestic security service, said it had seen more than 10,000 disguised approaches from foreign spies to people across the country on those sites, according to the British government's announcement.

Then the attacker builds trust. That might mean pretending to be a colleague who's locked out, offering friendship, a job or a business deal, or simply offering money, as in the Coinbase case.

Next comes the ask, which is usually small and sounds reasonable, like a password reset, a quick look at some records, or a payment that has to go out today. Often it arrives wrapped in a polite "just this once."

Finally, the attacker exploits what they've been given. This is the part that makes social engineering so hard to catch, because the attacker is now using real credentials and real permissions, and to most security tools that looks like ordinary work. IBM found that breaches which started with social engineering took an average of 254 days to find and contain (Abnormal's summary).

What actually helps

The six green tiles at the bottom are the habits I'd push for, starting with the two that would have changed most of the stories above.

If you run a help desk, never reset a password or MFA on the strength of a phone call alone. Hang up and call the person back on the number already on file, not the one the caller gives you, and require a second approver for accounts with powerful access. Every help desk story above would have played out differently if the agent had been allowed, and expected, to say "let me call you back."

Phishing-resistant MFA means sign-in methods like hardware security keys and passkeys, which check that you're on the real website and can't be talked out of you over the phone. Back in 2018, Google told Brian Krebs that once it required physical security keys for all of its 85,000-plus employees, it hadn't seen a single confirmed account takeover (Krebs on Security). Codes sent by text message are better than nothing, but a persuasive caller can still ask you to read one out.

Contractors need the same rules as employees. If your outsourced help desk can reset an executive's password, its agents need the same training, the same verification steps and the same monitoring as your own staff. It also helps to limit what support agents can see and export, and to notice when someone opens records they have no business reason to look at.

"Think before you link" is the name of the British government campaign about fake profiles on professional networks, and the advice applies well beyond government. Check unfamiliar connection requests before you accept them, and be wary of flattering recruiters or new contacts who seem keen to move the conversation somewhere private.

Treat urgency as a red flag. Every attack above leaned on some mix of urgency, secrecy, flattery or "just this once." When someone needs you to skip a step right now, that's the moment to slow down.

And do the training properly. If the KnowBe4 numbers are even roughly right, ongoing practice takes us from one in three people falling for a test to about one in 24. So the next time a security course or phishing test lands in your inbox, I hope you won't just click through it, because keeping our guard up is exactly what it's for.

Vigilance without the witch hunt

In July 2024, a faulty CrowdStrike update grounded flights and knocked systems offline around the world. CrowdStrike is a competitor of ours, and some people expected us to treat it as good news. Our chief executive saw it differently. She reminded us to learn from the failures of others, because we could just as easily make the same mistakes ourselves. I've thought about that a lot this week.

I'll finish with Captain Jean-Luc Picard. Sir Patrick Stewart died last month at 86, and one of his finest scenes comes at the end of the Star Trek episode "The Drumhead". Worf is kicking himself for helping someone he trusted without seeing what she really was. Picard tells him that the obvious villains are easy to spot, and that the dangerous ones hide behind good deeds. Then he says the line I used to close my LinkedIn post.

Vigilance, Mr. Worf, that is the price we have to continually pay.

What I love about that scene is its context. The whole episode is about a witch hunt, so Picard's warning cuts both ways. Vigilance doesn't mean treating every colleague as a suspect or every caller as a criminal, because that road leads somewhere ugly too. It means building habits and processes, like the call back and the second approver, that protect good people from their own helpfulness.

That's also why I don't want to pile on anyone who gets caught out, whether it's a help desk agent on a busy shift or the head of the world's most valuable chip company. Social engineering works because trust is how organisations get anything done. We can't stop trusting each other, so we need systems that check that trust for us, and the humility to remember that the next pile-up on the highway could be ours. There but for the grace of God go I.