A Misconfigured Setting Exposed 45 Million Records This Week — Is Your Business Next?
A single cloud misconfiguration inside McGraw-Hill’s Salesforce environment handed attackers access to 45 million records this week. Combined with breaches at Booking.com and Basic-Fit, and ransomware data showing 88% of incidents target small and mid-size businesses, the message for business leaders is clear: the biggest threats are not exotic — they are ordinary oversights in the tools you already use.
The McGraw-Hill Breach: A Cloud Configuration Gone Wrong
On April 14, the ShinyHunters ransomware group claimed responsibility for breaching McGraw-Hill through an improperly configured Salesforce instance. The attackers did not need to crack encryption or exploit cutting-edge vulnerabilities. They walked through a door that was left open.
The result was 45 million Salesforce records exposed — names, contact details, and other personally identifiable information that can fuel identity theft, phishing campaigns, and follow-on attacks against the people in those records. For a company of McGraw-Hill’s size, the legal exposure alone could stretch into the tens of millions of dollars. For the millions of individuals whose data is now circulating in criminal marketplaces, the consequences may take years to fully surface.
What makes this breach instructive for small and mid-size business leaders is not the scale. It is the method. Salesforce, HubSpot, Zoho CRM, and similar platforms are standard tools across businesses of every size. Each one comes with dozens of permission settings, access controls, and integration points. A single misconfigured field — a permission set too broadly, an API endpoint left exposed, a user role that grants more access than intended — can turn a trusted business tool into an open window.
If your organization uses any cloud-based CRM, project management, or customer data platform, the question is not whether your configuration is complex. It is whether anyone has audited it recently.
More Breaches This Week: Booking.com and Basic-Fit
McGraw-Hill was not alone. On April 12, Booking.com confirmed that a cybersecurity incident compromised customer reservation details — full names, email addresses, postal addresses, phone numbers, and even the special requests customers had attached to their bookings. The company has not disclosed the total number of affected records, but the breadth of exposed data types is concerning. For businesses that rely on third-party booking or scheduling platforms, this is a reminder that your customers’ data security is only as strong as the weakest link in your vendor chain.
A day later, Dutch fitness chain Basic-Fit disclosed that attackers had accessed records for one million members, including bank account details for a portion of those customers. The breach impacted operations across multiple countries and underscored a pattern that has been building throughout 2026: customer-facing businesses that store payment information remain high-value targets, regardless of their industry.
Neither Booking.com nor Basic-Fit operate in what most people would consider the “cybersecurity industry.” They are a travel platform and a gym chain. That is precisely the point. Attackers are not limiting themselves to technology companies. They are going where the data is, and for most businesses, that means the customer records sitting inside everyday operational tools.
The Numbers Behind the Headlines
These individual breach stories fit into a broader pattern that every business leader should have on their radar. Current data from multiple cybersecurity research organizations paints a stark picture of the ransomware landscape heading deeper into 2026:
- 88% of all ransomware incidents now involve small and mid-size businesses. The overwhelming majority of ransomware attacks are hitting organizations with limited IT staff and smaller security budgets.
- The average cost of a ransomware incident for a small business ranges from $120,000 to $1.24 million. That figure includes ransom payments, recovery expenses, lost revenue during downtime, and the cost of rebuilding trust with customers and partners.
- 60% of small businesses that suffer a cyberattack shut down within six months. The financial and operational shock is often more than a smaller organization can absorb, especially when it hits during a period when margins are already thin.
- The top three attack methods remain exploited software vulnerabilities (32%), compromised credentials (23%), and phishing emails (18%). None of these are exotic. They are known problems with known solutions.
One additional trend worth watching: data exfiltration is now present in 87% of ransomware attacks. Criminals are not just locking your files and demanding payment. They are stealing your data first and threatening to publish it if you refuse to pay. This double extortion strategy raises the stakes significantly because even if you have reliable backups and can restore your systems, your sensitive business and customer data may still end up on the dark web.
What Business Leaders Should Be Doing This Week
The gap between awareness and action is where most businesses get hurt. Reading about these breaches is a start, but the real question is whether your organization has taken concrete steps to close the doors that attackers are walking through.
Audit your cloud configurations. If your business uses any cloud-based platform that stores customer or employee data — CRM systems, accounting software, file storage, HR tools — verify that access permissions are set correctly. Who has admin access? Are there API integrations that were set up months ago and never reviewed? Does every user have the minimum level of access they need to do their job? If you do not know the answers, that is the first problem to solve.
Patch the software CISA flagged this week. The Cybersecurity and Infrastructure Security Agency added six actively exploited vulnerabilities to its catalog this week, including critical flaws in Fortinet’s FortiClient, Microsoft Exchange Server, and Adobe Acrobat Reader. Federal agencies have until April 30 to apply fixes. Your business should not wait that long. If you use any of these products, check with your IT provider about whether patches have been applied.
Confirm your multi-factor authentication coverage. Compromised credentials account for nearly a quarter of all successful attacks. Passwords alone are not sufficient. Multi-factor authentication adds a second verification step that stops the majority of credential-based attacks. If MFA is not enabled on every business-critical account — email, financial platforms, cloud storage, CRM — enable it today.
Review your incident response plan. If a breach happened at your organization tomorrow morning, does your team know who to call, what to shut down, and how to communicate with customers? Fifty-seven percent of security incidents are first detected by someone outside the organization, not by the company itself. Having a documented, rehearsed response plan is the difference between a contained incident and a business-ending crisis.
The breaches making headlines this week did not require advanced technical knowledge to prevent. They required attention, routine maintenance, and a commitment to treating cybersecurity as an operational priority — the same way you treat payroll, legal compliance, and insurance. The businesses that take those steps consistently are the ones that stay out of the headlines.
17 Clear Signs It’s Time to Outsource IT Operations
In today’s fast-paced digital world, managing IT operations in-house can be challenging for many businesses. At DE Executive Cyber, we understand the importance of recognizing when it is time to consider outsourcing your IT functions. Here are 17 clear signs that indicate it might be time to make the switch:
- Difficulty Finding Specialized Talent:If your business struggles to find or hire specialized IT talent, outsourcing can provide access to a diverse pool of experts without the overhead costs of hiring and training.
- Rising Salary Costs:Managing in-house IT support can be expensive, especially with the need for 24/7 coverage. Outsourcing can reduce these costs and allow you to invest in other areas of your business.
- Overstretched Internal Resources:When your internal IT team is constantly overwhelmed, it can lead to inefficiencies. Outsourcing can free up your team to focus on core business activities.
- Low Employee Retention Rates:High turnover in your IT department can disrupt operations. Outsourcing to a vendor with a stable workforce can provide consistent support.
- Frequent Downtime:If your business experiences frequent IT downtime, it may be a sign that your current setup is inadequate. Outsourcing can ensure better uptime and reliability.
- Security Concerns:Cybersecurity is critical, and if your in-house team lacks the expertise to handle evolving threats, outsourcing to specialists can enhance your security posture.
- Compliance Challenges:Keeping up with industry regulations can be complex. Outsourcing to a provider with compliance expertise can help you avoid legal and compliance issues.
- Scalability Issues: As your business grows, your IT needs will change. Outsourcing provides the flexibility to scale your IT services up or down as needed.
- Lack of Innovation:If your IT team is too focused on day-to-day tasks, they may not have time for innovation. Outsourcing can bring fresh perspectives and innovative solutions.
- High Operational Costs:Reducing operational costs is a priority for many businesses. Outsourcing can help lower expenses related to IT infrastructure and maintenance.
- Limited In-House Expertise:If your team lacks expertise in certain areas, outsourcing can fill those gaps with specialized knowledge and skills.
- Need for Advanced Technology:Keeping up with the latest technology can be challenging. Outsourcing ensures access to cutting-edge tools and solutions.
- Project Delays:If IT projects are consistently delayed, it may be time to consider outsourcing to improve project management and delivery.
- Customer Complaints:Frequent IT issues can lead to customer dissatisfaction. Outsourcing can improve service quality and customer experience.
- Strategic Focus:Outsourcing IT operations allows your business to focus on strategic initiatives rather than getting bogged down by technical details.
- Cost Predictability:Outsourcing can provide more predictable IT costs, making budgeting easier and more accurate.
- Disaster Recovery Needs: Effective disaster recovery is essential for business continuity. Outsourcing can ensure you have a robust plan in place.
Conclusion
Recognizing these signs can help you make an informed decision about outsourcing your IT operations. At DE Executive Cyber, we specialize in providing comprehensive IT services tailored to your business needs. Contact us today to learn how we can help you achieve greater efficiency, security, and innovation.
Need help?
The Benefits and Challenges of Cloud Migration
In today’s rapidly evolving digital landscape, businesses are increasingly turning to cloud migration as a strategic move to enhance their operations. At DE Executive Cyber, we understand the critical importance of staying ahead in the tech game. Let us explore the key benefits and challenges of cloud migration.
Benefits of Cloud Migration
- Cost Efficiency: Cloud migration can significantly reduce IT costs. By moving to the cloud, businesses can eliminate the need for expensive on-premises hardware and maintenance. This shift allows for a pay-as-you-go model, ensuring that you only pay for the resources you use.
- Scalability: One of the standout advantages of cloud migration is scalability. The cloud provides the flexibility to scale resources up or down based on demand. This means you can easily accommodate growth without the need for substantial upfront investments.
- Enhanced Security: Cloud service providers invest heavily in security measures to protect data. With advanced encryption, regular security updates, and robust disaster recovery options, your data is safer in the cloud than on traditional servers.
- Improved Collaboration: Cloud-based solutions enable seamless collaboration among team members, regardless of their location. This fosters better communication, productivity, and innovation within your organization.
Challenges of Cloud Migration
- Data Security and Privacy Concerns: While the cloud offers enhanced security, data breaches and privacy concerns remain a challenge. It is crucial to choose a reputable cloud provider and implement strong security protocols to safeguard sensitive information.
- Downtime and Service Interruptions: Migrating to the cloud can sometimes result in downtime and service interruptions. Proper planning and choosing the right migration strategy can help minimize these disruptions.
- Compliance and Legal Issues: Different industries have varying compliance requirements. Ensuring that your cloud provider complies with relevant regulations is essential to avoid legal complications.
- Cost Management: While cloud migration can be cost-effective, it is important to monitor and manage usage to prevent unexpected expenses. Implementing cost management tools and practices can help keep your budget in check.
Conclusion
Cloud migration offers numerous benefits that can transform your business operations, but it is not without its challenges. At DE Executive Cyber, we specialize in guiding businesses through the cloud migration process, ensuring a smooth transition and maximizing the advantages while mitigating the risks. Contact us today to learn how we can help your organization thrive in the cloud.
Need help?
Unlocking Affordable Cybersecurity: A Guide for Small Businesses
In today’s digital age, cybersecurity isn’t just a luxury—it’s a necessity. However, for small businesses operating on tight budgets and with limited personnel, crafting a robust cybersecurity strategy can seem daunting. Fear not! With the right approach, you can protect your business from cyber threats without breaking the bank.
- Prioritize Immediate Threats
Small businesses must focus on the most pressing cyber threats, such as phishing attacks and malware infections. These threats are common and can cause significant damage if not addressed promptly. Implementing basic security measures like email filtering and anti-malware software can go a long way in safeguarding your business.
- Educate Your Team
Your employees are your first line of defense against cyber threats. Regular training sessions on cybersecurity best practices can empower them to recognize and respond to potential threats. Topics should include identifying phishing emails, creating strong passwords, and safe internet browsing habits.
- Utilize Free and Low-Cost Tools
There are numerous free and affordable cybersecurity tools available that can provide substantial protection. For instance, using password managers, enabling firewalls, and utilizing free encryption tools can enhance your security posture without significant financial investment.
- Implement Multi-Factor Authentication (MFA)
Adding an extra layer of security through multi-factor authentication (MFA) can significantly reduce the risk of unauthorized access. MFA requires users to provide two or more verification factors to gain access to a system, making it much harder for cybercriminals to breach your defenses.
- Regularly Update Software
Keeping your software up to date is crucial in defending against cyber threats. Software updates often include patches for security vulnerabilities that cybercriminals could exploit. Ensure that all your systems, including operating systems and applications, are regularly updated.
- Backup Your Data
Data loss can be devastating for any business. Regularly backing up your data ensures that you can quickly recover in the event of a cyber attack. Use both on-site and cloud-based backup solutions to protect your critical information.
- Develop an Incident Response Plan
Having a well-defined incident response plan can help you quickly and effectively respond to a cyber-attack. This plan should outline the steps to take in the event of a breach, including who to contact, how to contain the threat, and how to recover.
Conclusion
Cybersecurity doesn’t have to be expensive or complicated. By focusing on immediate threats, educating your team, and utilizing affordable tools, small businesses can build a strong defense against cyber threats. Remember, the key is to stay vigilant and proactive in your cybersecurity efforts.
Need help?
Understanding Consumer and Enterprise VPNs: A Comprehensive Guide
In today’s digital age, Virtual Private Networks (VPNs) have become essential tools for ensuring online privacy and security. However, not all VPNs are created equal. There are significant differences between consumer VPNs and enterprise VPNs, each tailored to meet specific needs. In this blog post, we’ll explore these differences, helping you understand which type of VPN is right for you.
What is a VPN?
A VPN, or Virtual Private Network, creates a secure, encrypted connection between your device and the internet. This connection masks your IP address, making your online actions virtually untraceable. VPNs are used for various purposes, from protecting personal data to securing corporate networks.
Consumer VPNs
Consumer VPNs are designed for individual users who want to protect their personal data and maintain privacy while browsing the internet. These VPNs are particularly popular among people who are concerned about their online privacy and security. They offer a straightforward way to ensure that your internet activities remain private and secure, even when using public Wi-Fi networks.
- Ease of Use: Consumer VPNs are typically user-friendly, with simple interfaces that require minimal technical knowledge.
- Privacy and Anonymity: They help users maintain anonymity online by masking their IP addresses and encrypting their internet traffic.
- Access to Geo-Restricted Content: Many users opt for consumer VPNs to access content that is restricted in their region, such as streaming services.
- Cost: Consumer VPNs are generally affordable, with various pricing plans to suit different budgets.
Enterprise VPNs
Enterprise VPNs, on the other hand, are designed for businesses and organizations. These VPNs are crucial for companies that need to protect sensitive data and ensure secure communication between remote employees and the corporate network. They provide a higher level of security and control, which is essential for maintaining the integrity of business operations.
- Advanced Security: Enterprise VPNs provide higher levels of security, including multi-factor authentication, advanced encryption protocols, and intrusion detection systems.
- Scalability: These VPNs can support a large number of users and devices, making them suitable for businesses of all sizes.
- Centralized Management: IT administrators can manage and monitor the VPN network centrally, ensuring compliance with corporate policies and security standards.
- Dedicated Support: Enterprise VPNs often come with dedicated customer support and service level agreements (SLAs) to ensure minimal downtime and quick resolution of issues.
Key Differences
When comparing consumer and enterprise VPNs, it’s important to understand the key differences that set them apart. These differences are primarily driven by the distinct needs of individual users versus businesses. While both types of VPNs aim to provide secure and private internet access, their features and functionalities are tailored to meet different requirements.
- Purpose: Consumer VPNs focus on individual privacy and access to restricted content, while enterprise VPNs prioritize secure communication and data protection for businesses.
- Security: Enterprise VPNs offer more advanced security features compared to consumer VPNs.
- Management: Enterprise VPNs provide centralized management capabilities, which are not typically available in consumer VPNs.
- Cost: Enterprise VPNs are generally more expensive due to their advanced features and support services.
Choosing the Right VPN
Choosing the right VPN depends on your specific needs and circumstances. For individuals, the primary concern is often privacy and access to restricted content. For businesses, the focus is on securing sensitive data and ensuring reliable communication channels for employees. Understanding these needs will help you make an informed decision.
- For Individuals: If you’re looking to protect your personal data, maintain privacy, and access geo-restricted content, a consumer VPN is likely the best choice.
- For Businesses: If you need to secure sensitive corporate data, support multiple users, and ensure compliance with security policies, an enterprise VPN is the way to go.
Conclusion
Both consumer and enterprise VPNs play crucial roles in today’s digital landscape. By understanding their differences and features, you can make an informed decision that best suits your needs. Whether you’re an individual seeking online privacy or a business aiming to protect corporate data, there’s a VPN solution out there for you.
Protecting Your Accounts: A Guide to Strong Passwords, MFA, and more
In today’s digital age, securing your online accounts is more important than ever. With cyber threats on the rise, it’s crucial to take steps to protect your personal information. This blog post will guide you through creating strong passwords, using multi-factor authentication (MFA), and managing your passwords effectively.
Creating Strong Passwords
A strong password is your first line of defense against hackers. Here are some tips to create a robust password:
- Length: Aim for at least 12 characters. The longer, the better.
- Case Sensitivity: Use a mix of uppercase and lowercase letters.
- Numbers: Include numbers to add complexity.
- Special Characters: Use symbols like !, @, #, $, etc.
For example, a strong password could look like this: DE7Executive7R0Ck$.
The Best Kind of Multi-Factor Authentication (MFA)
MFA adds an extra layer of security by requiring more than just your password to access your account. There are different types of MFA, but not all are created equal:
- Authenticator Apps: These apps, like Google Authenticator or Authy, generate a time-based code that you enter along with your password. This method is highly secure because the code changes every 30 seconds and is not transmitted over the internet.
- SMS Codes: Receiving a code via text message is better than no MFA at all, but it’s less secure than an authenticator app. Text messages can be intercepted or SIM-swapped.
Using an authenticator app is the best option, but if that’s not possible, SMS codes are still a good step up from just using a password.
Password Managers
Remembering multiple strong passwords can be challenging. That’s where password managers come in. A password manager stores all your passwords in an encrypted vault, so you only need to remember one master password. Popular password managers include LastPass, 1Password, and Bitwarden.
Checking for Compromised Passwords
It’s a good idea to periodically check if your passwords have been compromised in a data breach. The website Have I Been Pwned allows you to enter your email address and see if it has been involved in any known breaches. This can help you know when it’s time to change your passwords.
Check now to see if your password is safe!
Conclusion
Securing your online accounts doesn’t have to be complicated. By creating strong passwords, using MFA, and managing your passwords with a password manager, you can significantly reduce the risk of your accounts being hacked. Regularly checking for compromised passwords on sites like Have I Been Pwned adds an extra layer of vigilance. Stay safe online!
Microsoft vs. Google: The Great Debate for Businesses
When it comes to choosing between Microsoft and Google for your business needs, the decision isn’t always straightforward. Both platforms offer a plethora of features that can cater to different organizational requirements. Here’s a deeper dive into what each has to offer and how to determine which might be the best fit for your business.
Microsoft: The Powerhouse of Productivity
Office Suite: Microsoft Office, including Word, Excel, and PowerPoint, is renowned for its robustness and versatility. One of its standout features is the ability to work offline, which is essential for those times when internet access is unreliable or unavailable. This can be a significant advantage when working on documents, spreadsheets, or presentations, especially in collaboration with clients and vendors.
Integration: Microsoft 365 integrates seamlessly with other Microsoft products like Windows, Azure, and Dynamics 365. This creates a cohesive ecosystem that can streamline workflows and improve productivity.
Security: Microsoft is known for its strong security features, making it a preferred choice for enterprises with stringent security requirements. Its comprehensive security measures help protect sensitive data and ensure compliance with various regulations.
Learning Curve: While Microsoft tools are powerful, they can have a steeper learning curve, particularly for those new to the ecosystem. However, the investment in learning can pay off with increased efficiency and capabilities.
Google: The Champion of Collaboration
G Suite: Google Workspace, which includes Docs, Sheets, and Slides, is designed for real-time collaboration. Its user-friendly interface makes it easy for teams to work together, even if they are in different locations. However, it primarily requires an internet connection, which can be a limitation in some scenarios.
Cost: Google offers competitive pricing, with free tiers for basic use. This makes it an attractive option for startups and small businesses looking to minimize costs while still accessing powerful tools.
Third-Party Integration: Google Workspace integrates well with various third-party apps, allowing businesses to extend its functionality. However, for more advanced features, additional tools might be necessary.
Ease of Use: Generally, Google Workspace is easier to learn and use, which can be beneficial for teams looking to get up and running quickly without a steep learning curve.
Key Considerations
Offline Work: If your business requires the ability to work offline, Microsoft is the clear winner. Its offline capabilities ensure that you can continue working without interruption, regardless of internet connectivity.
Collaboration: For real-time collaboration, Google Workspace excels. Its tools are designed to facilitate seamless teamwork, making it ideal for businesses that prioritize collaborative efforts.
Ecosystem: Consider the other tools and services your business uses. Microsoft 365 is designed to work seamlessly with a wide range of third-party tools and services. This includes popular CRM systems, project management tools, and other business applications, allowing for a more integrated and efficient workflow.
Conclusion
Ultimately, the best platform for your business depends on your specific needs and existing infrastructure. Take the time to evaluate your requirements, consider the strengths and weaknesses of each platform, and choose the one that aligns best with your business goals. Whether you opt for Microsoft or Google, both offer powerful tools that can help drive your business forward.
We want to be upfront about our preference: we are a reseller of Microsoft 365. This allows us to offer you some great benefits, such as managing your Microsoft 365 environment at no additional cost and providing free migration services. Our aim is to make your transition to Microsoft 365 as smooth and cost-effective as possible, so you can focus on growing your business with confidence.







