Just once, I’d like to see a company come forward and say “we got badly breached, and we analyzed the evidence, and you know what, we don’t think the adversary was extremely sophisticated at all”
Michal Zalewski (lcamtuf) asked for that sentence in Fediverse. I replied “challenge accepted”, as a matter of historical record.
In twenty years of breach disclosures I have found it exactly once, in 2025, in a lawsuit that put the blame on a vendor anyway. Regulators are the ones who write it often, usually a year or two after a chief executive put the word “sophisticated” into a press release. The herd of chief executives (ironic, no?) reaches for “sophisticated” by reflex. Only a thin file of them said something closer to “oops, duh” than “wow, who could have known.”
This post is a trip down memory lane, and it collects exact quotes, with links to the filing, transcript, penalty notice or original report where it appears. It’s similar to posts I’ve done in the past, but more targeted to the question of accepting fault.
1755
Let’s talk about “sophisticated” as a particular term in breach disclosure defense filings. I have called it out since at least 2011 when I gave a series of talks about state-level breaches, attempting to convince our industry to stop using the word.
Samuel Johnson defined it in his 1755 Dictionary as “To adulterate; to corrupt with something spurious.” For the noun, he quoted medical writer John Quincy: “the act of counterfeiting or adulterating any thing with what is not so good, for the sake of unlawful gain.” Merriam-Webster still gives “to alter deceptively; especially : adulterate” as the first sense of the verb, in use since the fifteenth century.
A sophisticated act is, in the literal sense, a breach of integrity. Like someone serving colored water and calling it wine, or someone who fails the bar yet says they are a lawyer. Sophisticated attacker means a defender has been duped, in even the most basic way.
The self-flattering pivot of the word came very late. Etymonline dates “worldly-wise” to 1895, and the OED’s first citation for “complex or advanced” is C. S. Lewis in 1945, as Wordorigins reports. A breach statement that calls an attack sophisticated uses the youngest, and usually least applicable, sense of a word that meant a counterfeit for the prior five hundred years.
The modern sense therefore becomes a measure of the speaker, not the breach. In Was Stuxnet the “First”? I argued that calling an attack sophisticated mostly tells you the observer does not yet understand it. Verizon’s investigators had already said as much in their 2013 report, writing that attack difficulty “almost certainly reveals much more about the skill and readiness of the defender.” Lawyers then read the absence of the word as a confession of negligence, putting pressure on constant use as a get-out-of-jail card. Instead of claiming drunkenness and promising rehab, the executive claims the drink was complex and advanced. Thus the “sophisticated attack” became a confession of ignorance dressed up as a legal defense, one the courts have yet to accept.
2005 to 2010
An early clean admission came from Derek Smith of ChoicePoint, testifying to a House subcommittee on 15 March 2005. Criminals posing as small businesses had bought consumer files from his company. Smith apologized to consumers harmed by “criminals whose fraudulent activity ChoicePoint failed to prevent,” and when asked about warning signs he said “we should have recognized sooner the magnitude of that particular crime.” He described the criminals only by what they did.
The FTC fined ChoicePoint $10 million the following January because it “did not have reasonable procedures to screen prospective subscribers.”
Four months after Smith, John Perry of CardSystems Solutions showed the House how to talk out of two sides in one hearing. On 21 July 2005 he testified that “the attack on our system was very sophisticated.” Pressed later in the same session about the card data his company had kept, he said “we have stated that we were in error by keeping that data.” Visa’s witness at the same table said CardSystems had “knowingly and improperly retained magnetic stripe information.” I remember this case well, and CardSystems didn’t even use firewalls. Literally named “card systems” for payment cards, zero security.
The FTC’s complaint the next year described a SQL injection against a web application and found the company “did not implement simple, low-cost, and readily available defenses.” The words “readily available” run through the FTC’s orders of that period, against DSW, Guidance Software and TJX.
TJX took a third path. Its 2007 10-K described “the technology used by the Intruder” and an intruder who “had access to the decryption tool,” and left the adjective to the reader. My post on the TJX theft read that decryption tool as a key management failure. Canada’s privacy commissioners found TJX had protected its store wireless networks with WEP, which “can be defeated relatively easily.”
Ah, WEP. At a tech conference when WEP was first introduced I met with the 3Com engineers demonstrating the first WiFi routers with encryption. They had plastic cases with the SSID and password raised in the actual hard plastic.
What about rotation, I asked, since my secret should be a secret. They replied adoption needed ease of use, or there would be no encryption at all, secrets slow down use. Jesus WEP’d.
Hannaford Bros. disclosed in March 2008 and passed along a law enforcement assessment of a “new and sophisticated method.” In August 2009 the Justice Department indicted Albert Gonzalez for the Hannaford, Heartland and 7-Eleven intrusions, and its press release called SQL injection “a sophisticated hacking technique.” The adjective showed up as prosecution.
Robert Carr of Heartland Payment Systems then stood on a soap-box and said all of this out loud for the herd to hear. In August 2009 he told CSO that his assessors’ audits “were of no value whatsoever,” and in the same interview said “We need more humility” and “you can easily buy sniffer software off the shelf.”
This is my shocked face.
On 9 September he told SC Magazine “We thought we had protected ourselves, but we didn’t do enough,” and conceded “This was a website that they could get into.”
It was like “sophisticated” was finally going to be washed away.
Five days later he testified to the Senate about “the ever more sophisticated methods used by these cyber criminals.”
Damn it.
By July 2010 his first lesson for other executives was “Don’t blame other people.” Visa had answered the auditor complaint back in March 2009: “No compromised entity has yet been found to be in compliance with PCI DSS at the time of a breach.”
Word games. Compromise means non-compliant.
Verizon’s 2010 report, covering 2009 cases, found 96 percent of breaches “avoidable through simple or intermediate controls.” Sophisticated meant low bar, as in you aren’t doing the basics. Yet it clearly was being deployed for legal smoke to avoid charges of negligence.
2011
The argument for owning the basics really took off in 2011. Verizon’s April report repeated the news and said “90% of attacks are not highly sophisticated, and the method of intrusion is relatively straightforward in most cases.”
I spent that year giving talks on why Stuxnet was less sophisticated than its coverage claimed. By the time the antivirus vendors were hot-selling Flame in 2012, I could write “Apparently Stuxnet is no longer considered sophisticated.”
RSA’s disclosures that year carried both registers at once. On 18 March the illustrious Art Coviello described an “Advanced Persistent Threat” attack. Two weeks later RSA’s Uri Rivner explained that a phishing email had been “crafted well enough to trick one of the employees to retrieve it from their Junk mail folder,” and called the whole thing an “extremely sophisticated cyber attack.”
F-Secure later recovered the message. Its body read:
I forward this file to you for review. Please open and view it.
The attachment carried a Flash zero-day. The delivery was two sentences. Sophisticated.
Sony told Congress in May 2011 that the PlayStation Network intrusion was a “very carefully planned, very professional, highly sophisticated criminal cyber attack.” The UK Information Commissioner fined Sony in January 2013 and found “the attack could have been prevented if the software had been up-to-date.” Sony dropped its appeal that July with the line “We continue to disagree with the decision on the merits.” Citigroup said almost nothing about its own 2011 breach, in which account holders changed digits in the browser address bar and reached other people’s accounts. My old colleague Bruce Schneier called the missing control “kindergarten security.”
Honestly, I would expect better even from a kindergartener.
On 13 October 2011 the SEC’s Division of Corporation Finance issued its first guidance on cyber disclosure. It told issuers that detail amounting to a “roadmap” for attackers was “not required under the federal securities laws.” The Verizon statistic and the SEC guidance were just six months apart. From then on public companies drafted breach statements with permission to leave out the details, which is an invitation to turn adjective abuse up to 11.
2012 to 2016
Dropbox wrote a plain admission in July 2012, after passwords stolen from other websites were used against its users: “A stolen password was also used to access an employee Dropbox account.”
Target spoke out of both sides of its mouth. A spokeswoman said on 19 December 2013 “It is very clear it is a sophisticated crime.” Chief executive Gregg Steinhafel told CNBC “Clearly we are accountable and we are responsible.” Can it be both? The Senate Commerce Committee’s majority staff then documented stolen vendor credentials and security alerts that went unanswered, and quoted McAfee calling the point-of-sale malware “absolutely unsophisticated and uninteresting.”
A federal judge let the banks’ negligence claims proceed in December 2014 and wrote “Although the third-party hackers’ activities caused harm, Target played a key role in allowing the harm to occur.” The ruling was about what Target allowed to happen.
Dido Harding of TalkTalk delivered a plain answer in October 2015 on the BBC. Asked whether customer data had been encrypted, she said “The awful truth is, I don’t know.” Her company’s statements that month described criminals “becoming increasingly sophisticated.” Police arrested a 15-year-old.
I mean, it wasn’t a kindergartener, but still.
In December Harding told a Commons committee “Cyber security is a board level issue, and I am responsible for it.” The Information Commissioner’s penalty in October 2016 found “TalkTalk’s failure to implement the most basic cyber security measures allowed hackers to penetrate” its systems by SQL injection, through a database bug whose fix had been available “for over three and a half years.”
A very sophisticated amount of time.
In June 2015, four months before Harding’s BBC interview, the director of the US Office of Personnel Management told senators “I don’t believe anyone is personally responsible.”
2017 to 2022
Dara Khosrowshahi disclosed Uber’s concealed 2016 breach in November 2017 with a sentence that puts the whole failure on Uber: “None of this should have happened, and I will not make excuses for it.”
Richard Smith of Equifax wrote an ugly testimony the month before. The breach “occurred because of both human error and technology failures,” and the data was lost “at the hands of sophisticated cybercriminals.” The House Oversight majority found in December 2018 that “Such a breach was entirely preventable.” Capital One’s July 2019 filing blamed “a highly sophisticated individual” exploiting “a specific configuration vulnerability.” The OCC’s $80 million order the next year cited the bank’s “failure to establish effective risk assessment processes” before it moved significant operations to the public cloud. British Airways argued to the ICO that its attacker made conscious efforts to avoid detection. The penalty notice recorded that argument and then found a compromised supplier account without multi-factor authentication and administrator login details “stored in plain text.”
Perhaps most notably, the New York’s Department of Financial Services wrote lcamtuf’s sentence in October 2020 about the Twitter hijacking. Twitter had described “a phone spear phishing attack.” The regulator’s report called the attackers “a group of unsophisticated cyber crooks” using “basic techniques more akin to those of a traditional scam artist.”
Boom. There it is, although from a regulator.
Joseph Blount of Colonial Pipeline told the Senate in June 2021 that the ransomware crew entered through a legacy VPN profile that “did only have single-factor authentication.” In the same answer he said “It was a complicated password, so I want to be clear on that.” Blount defended his own concept of a “complex” password, and when Senator Portman asked whether multi-factor authentication should be used, he said “that is absolutely the correct advice.” He also said “We are accountable for our defenses.” Colonial then hired its first ever CISO, nearly a year after it had tripped over its clown shoes into a basic ransomware attack.
Optus produced a three-part record. Chief executive Kelly Bayer Rosmarin said of the September 2022 breach “it’s a sophisticated attack.” Home Affairs Minister Clare O’Neil said Optus had “effectively left the window open.” The communications regulator told the Federal Court in 2024 that the attack was “not highly sophisticated or one that required advanced skills” and was “carried out through a simple process of trial and error.”
The SMS phishing wave of summer 2022 shows an evolution. Twilio called its attackers “well-organized, sophisticated and methodical.” That’s like saying unknown kmown. Cloudflare titled its write-up “The mechanics of a sophisticated phishing scam and how we stopped it,” and the body reports that three employees entered their credentials and hardware security keys stopped the rest. In September Uber’s 8-K exhibit gave a literal account: “It is likely that the attacker purchased the contractor’s Uber corporate password on the dark web.” The contractor rejected repeated login approval requests. “Eventually, however, the contractor accepted one, and the attacker successfully logged in.”
2023 to 2026
CircleCI wrote a single sentence in January 2023: “While one employee’s laptop was exploited through this sophisticated attack, a security incident is a systems failure.”
Microsoft described its Midnight Blizzard intrusion in January 2024 as a password spray against “a legacy, non-production test tenant account” that “did not have multifactor authentication (MFA) enabled.” The Cyber Safety Review Board found the earlier Storm-0558 intrusion “was preventable and should never have occurred.”
Brad Smith answered in June that “Microsoft accepts responsibility for each and every one of the issues cited in the CSRB’s report.” The same testimony calls Russia’s SVR one of the “most sophisticated cyber agencies in the world.” By 2024 this annoying adjective had moved from the attack itself to the attacker’s employer.
Andrew Witty of UnitedHealth gave a one-sentence admission in written testimony on 1 May 2024: “The portal did not have multi-factor authentication.” He added “I am deeply sorry.” He delayed using the adjective for what happened until after entry, when the attackers “moved laterally within the systems in more sophisticated ways.” Senator Wyden called the missing control “cybersecurity 101.”
23andMe went the other direction and blamed its customers. Its January 2024 letter to plaintiffs said “users negligently recycled and failed to update their passwords.” It’s a good thing biometric login wasn’t blamed or the customers might have been accused of having poor DNA. The UK Information Commissioner fined the company £2.31 million in June 2025 and said “23andMe failed to take basic steps to protect this information.” At Marks and Spencer the chief executive and the chairman gave different accounts seven weeks apart. Chief executive Stuart Machin said in May 2025 “we were unlucky on this particular day through some human error.” Chairman Archie Norman told Parliament in July that social engineering is “a euphamism for impersonation” and that “it was a sophisticated impersonation.”
The SEC’s October 2024 order against Mimecast shows where the regulator takes its stand4. Mimecast’s January 2021 8-K said the company “has been compromised by a sophisticated threat actor” and said a “low single digit number” of customers had been targeted. The SEC found the actor had reached encrypted credentials for roughly 31,000 customers and fined Mimecast $990,000. The penalty attached to the understated scope. The adjective landed yet again.
Table time
The answer
That leaves us back at lcamtuf’s sentence.
In July 2025 Clorox sued Cognizant, the contractor that ran its help desk, for $380 million over the 2023 breach. The complaint quotes the call in which a Cognizant agent answered an outside caller with:
Clorox’s lawyers wrote:
Cognizant “was not duped by any elaborate ploy or sophisticated hacking techniques.”
There it is. That is the sentence, filed in court by a breached company about its own attacker. Cognizant replied:
Clorox had “such an inept internal cybersecurity system.”
Children, settle down.
A breached company seems to have stepped up to call its adversary unsophisticated, the day that negligence sticks to someone else.