Hi all, a bit of story time. I became a head of IT in smaller company and to be honest the security is not great. I’m trying to convinvince the shareholders that we should take it more seriously, but so far to no avail.

The most comon argument is, that unless it’s our user data it’s not that big of a deal. I’m arguing, that if somebody has access to our accounts, they can get all the data they want, however their response is just scepticism.

We actually had some phishing attacks with a breach to our CEO’s email. The CEO just plain refuses it even though we had to block his account, reset passwords also for 3 other employees who clicked the credentials stealing link he sent from his email.

To be honest I partially understand it, because they are not very technical and can’t even imagine the threats. I would hire a pen tester to show them the possibilities, however in our country there are not so many (only 1 company as far as I know)

I tried some services lile spyCloud, but because they are pretty vague (big red 56% password reuse or 100k minor security issues), they don’t tell the story. The response to that was “yeah of course they have to tell you this, otherwise they wouldn’t make money”

So I’m getting a bit desperate and was thinking if I was able to find some database dump of ours in the wild it would surely be the needed proof. The problem is I was never on the other side and don’t even know where to look at for something like this?