Coming October 20, 2026
Built Wrong
Why Cybersecurity Keeps Failing and How We Can Rebuild It
Read more →
Writing
Three books, a live cyber loss tracking index and dozens of authored pieces.
The writing comes from experience in the seat and researching the paradoxes and hidden truths in cybersecurity. From lighthearted stories about personal growth to the co-authoring of security standards and industry position papers, the focus is always on discovering truth and sharing it.
Launch updates
Built Wrong arrives on October 20, 2026. The Kindle edition is open for pre-order now. Leave an email and I will tell you when it ships.
An email address and nothing else. You confirm it before anything is sent, and every message carries an unsubscribe link that works. What this list is.
"Built Wrong" is a book filled with uncomfortable truths. I'm sure that it will anger quite a few people, but hopefully it will open the eyes of even more.
John KindervagCreator of Zero Trust
The index
The Hacker in a Hoodie Index
A wholly unique live public record of what individual cyber incidents actually cost. Every figure is read from the document that reported it and graded by how well it is attested. The figures are never summed into a total, because within that total are dollar amounts and types that can't simply be added together. Doing so would create a manufactured figure that reflects a loud headline number, but not the truth of the losses, who they impacted and how.
Most recently added
- Oct 16, 2026
BAE Systems: not yet quantified
Attested figure. Not yet quantified, disclosed Oct 2026, Technology and Software. A cybersecurity incident at BAE Systems knocked out the Bankruptcy Noticing Center it runs for the Federal Judiciary, halting bankruptcy notices for every federal bankruptcy court nationwide. The judiciary has not said what happened, when it began, or whether any data was accessed or taken. Every bankruptcy court in the country shared one failure domain, and it belonged to a contractor. Source: BAE Systems cyberattack disrupts US federal court operations.
Technology and Software - Oct 16, 2026
Burger King Japan: not yet quantified
Attested figure. Not yet quantified, disclosed Oct 2026, Retail and Consumer. An outside party spent October 2 to October 7, 2026 inside BK Japan's app member system, reaching about 11.18 million records: names, email addresses, and mobile order history. How they got in, and who they were, the source does not say. Every member in the app sat behind one store of identity, a single failure domain the size of the entire loyalty program. No card data, the company stresses. Just a record of what each person ordered, tied to a name and an inbox. Source: Burger King Japan data breach exposes 11 million customer records.
Retail and Consumer - Oct 15, 2026
MLD Mortgage Inc. dba The Money Store: not yet quantified
Verified figure. Not yet quantified, disclosed Sep 2026, Financial Services. An intruder entered The Money Store's network on September 8, 2026, through a remote monitoring and management platform used by a third-party service provider; unusual activity surfaced a day later. Storm, the ransomware group claiming the attack, posted the lender's name to its leak site within two weeks, and the filing gives no count of those affected. Inside sat whole loan files: Social Security numbers, account details, income, and credit histories. A vendor tool built to reach every machine did exactly that, for whoever held the controls. Source: California AG breach notification.
Financial Services - Oct 15, 2026
City of Foster City: not yet quantified
Verified figure. Not yet quantified, disclosed Feb 2026, Public Sector and Education. Ransomware sat inside Foster City's systems from February 28 to March 25, 2026, taking names, birthdates, and health insurance numbers, and for a smaller group Social Security, passport, and medical records. Staff noticed on March 19, and the intruder kept access for six more days. The source never says how they got in, who they were, or how many people were hit. Containment meant unplugging the whole city at once, and only 911 sat outside the blast radius. Source: California AG breach notification.
Public Sector and Education - Oct 15, 2026
Legal Aid Agency: not yet quantified
Attested figure. Not yet quantified, disclosed Oct 2026, Professional and Business Services. Attackers reached the Legal Aid Agency's IT systems in April 2025 and took applicant data: national ID numbers, criminal histories, debts, payments, and providers' LAA Online Portal credentials. Who they were, how they got in, and how many people are affected go unsaid. The October 2026 update puts roughly 250,000 records before 2007, the oldest from 1978. The blast radius was set by whoever decided a 1978 record still belonged on a reachable system, or any of the nearly 50 years of retained data after National Lampoon's Animal House premiered. Source: Legal Aid Agency data breach: Compromised records date back to 1978.
Professional and Business Services
The books
Coming soon
The Verified Security Framework
The Operating Manual for Built Wrong: Why Cybersecurity Keeps Failing and How We Can Rebuild It
Published 2024
Famous With 12 People
A Career Guide On How To Be An Internationally Recognized Expert In Something Nobody Cares About
Read more →