Phishing Case Studies: 11 Real Attacks and Lessons Learned (2026)

Updated September 2026. We added six phishing and social engineering cases from 2022 to 2025, corrected our Colonial Pipeline section (that attack started with a leaked password on a VPN account without multi-factor authentication, not a phishing email), and replaced a broken source link. Each case links to a primary or reputable source.

Phishing is still the most common way attackers get in. Phishing and spoofing were the most-reported crime type to the FBI in 2025, with 191,561 complaints (FBI IC3), and IBM found phishing was the top initial attack vector in data breaches for the fourth year running (IBM). The cases below show how the tactics have moved from email to text messages, phone calls and deepfakes, and which defenses actually worked.

Phishing case studies at a glance

1. AOL “AOHell” scams (1995)

The mid-1990s AOL scams are among the earliest recorded phishing attacks and are often credited with popularizing the word “phishing.” Attackers used a toolkit called AOHell, which generated fake credit card numbers to open accounts, and sent instant messages posing as AOL staff to trick users into handing over passwords and billing details (KnowBe4).

Lesson: don’t trust messages just because they claim to come from customer service. Contact the company through its official website or app.

2. Target customer data theft (2013)

Attackers first compromised Fazio Mechanical, a refrigeration contractor that had access to Target’s vendor systems. A phishing email led to the Citadel malware being installed at Fazio, which stole the credentials used to get into Target’s network, where the attackers installed card-stealing malware on point-of-sale systems (ZDNet).

Lesson: third parties are a common way in. Limit what vendors can reach, segment networks, and require MFA for vendor access.

3. Facebook and Google invoice fraud (2013–2015)

A Lithuanian man, Evaldas Rimasauskas, posed as an Asia-based hardware manufacturer that both companies really did business with. Employees received phishing emails and fake invoices and wired more than $100 million to accounts he controlled (BBC). This is an early, large example of what we now call business email compromise, which cost U.S. victims more than $3 billion in 2025, according to the FBI.

Lesson: confirm any new or changed payment details by calling a known contact, not the number or email in the request.

4. Celebrity iCloud phishing (2015–2018)

Between 2015 and 2018, Kwamaine Ford emailed celebrities while posing as Apple customer service and asked them to change or share their passwords. More than 100 victims, including athletes and musicians, gave him access to their iCloud accounts, and he charged their credit cards to fund his lifestyle. He was sentenced in 2019 (FBI). This kind of targeted phishing against high-profile people is often called whaling.

Lesson: legitimate companies won’t ask for your password by email. Turn on MFA and review which devices are signed in to your accounts. Our guide to social media security covers similar account takeover scams.

5. Cloudflare and Twilio SMS phishing (2022)

In July and August 2022, the same group sent text messages to employees at many companies, pointing them to fake Okta login pages that relayed credentials and one-time codes to the attackers in real time.

• At Twilio, the attackers got in and accessed data belonging to 163 customers (Twilio).
• At Cloudflare, at least 76 employees got the texts and three entered their credentials, but the attack failed because every employee used a FIDO2 hardware security key instead of one-time codes (Cloudflare).

Lesson: phishing-resistant MFA (security keys or passkeys) works even when people make mistakes. See our guide to multi-factor authentication.

6. Uber (2022)

An attacker, whom Uber linked to the Lapsus$ group, likely bought a contractor’s Uber password on the dark web after malware on the contractor’s personal device exposed it. The attacker then sent repeated MFA push requests until the contractor accepted one, and went on to reach internal tools including Slack and G Suite (Uber).

Lesson: push-approval MFA can be worn down by “MFA fatigue.” Use number matching or phishing-resistant methods, and alert on repeated push requests.

7. Retool (2023)

Several Retool employees got texts claiming an account problem would affect their health insurance enrollment. One employee logged in on the fake portal, and the attacker then called them with a deepfaked voice of a real IT staff member and got one more MFA code. Because the employee’s Google Authenticator codes were synced to their Google account, the attacker gained access to internal systems and took over 27 cloud customer accounts (Retool).

Lesson: cloud-synced one-time codes can turn MFA into a single point of failure. Retool’s own conclusion was that FIDO2 hardware keys resist this kind of attack.

8. MGM Resorts (2023)

In September 2023, a cyberattack disrupted MGM’s hotels and casinos for days. MGM said it expected a negative impact of about $100 million on its third-quarter Adjusted Property EBITDAR (MGM Form 8-K). The attackers, identified as Scattered Spider, an affiliate of the ALPHV/BlackCat ransomware group, used social engineering to get in (BleepingComputer). Widely reported claims say they called the IT help desk while posing as an employee. CISA’s advisory on the group describes exactly this pattern of targeting help desks to reset passwords and MFA (CISA).

Lesson: the help desk is a front door. Require strong identity checks before resetting passwords or MFA, especially for privileged accounts.

9. Arup deepfake video call (2024)

An employee at engineering firm Arup in Hong Kong joined a video call with what appeared to be the company’s CFO and other colleagues. All of them were deepfakes. The employee made a series of transfers totaling about $25 million (CNN).

Lesson: voice and video can be faked. Large payments need a second approver and a callback to a known number.

10. Salesforce vishing campaign (2025)

Google’s threat intelligence team tracked a group it calls UNC6040 that phoned employees while posing as IT support. The callers talked victims into approving a malicious version of Salesforce’s Data Loader app, then used it to steal large amounts of customer data for extortion. One of Google’s own corporate Salesforce instances was affected by similar activity (Google Cloud).

Lesson: the attack didn’t exploit a software flaw. Restrict which connected apps users can authorize, apply least privilege and watch for unusual data exports.

11. Marks & Spencer (2025)

In April 2025, UK retailer Marks & Spencer suspended online orders for weeks after a cyberattack. The attackers used social engineering and got in through a third party that worked with M&S. The company estimated the cost at about £300 million in lost operating profit (BBC).

Lesson: social engineering can cause months of business disruption, not just a data leak. Test your incident response and business continuity plans.

Correction: Colonial Pipeline (2021) wasn’t a phishing attack

An earlier version of this article said the Colonial Pipeline ransomware attack started with phishing. That was wrong. Colonial’s CEO told the Senate that attackers got in through a legacy VPN profile (Senate testimony). Mandiant, which investigated, said the VPN account didn’t use multi-factor authentication and its password had turned up in a batch of leaked passwords on the dark web. Mandiant’s Charles Carmakal said, “We don’t see any evidence of phishing for the employee whose credentials were used” (Al Jazeera/Bloomberg). Colonial paid a ransom of about 75 bitcoin, and the Justice Department later recovered 63.7 bitcoin, then worth about $2.3 million (DOJ).

Lesson: stolen or reused passwords are dangerous even without phishing. Remove unused accounts, require MFA on all remote access, and use unique passwords. See our password policy best practices.

What these cases have in common

• Attackers impersonate someone you trust: support staff, IT, a supplier or an executive. Our breakdown of what nearly all phishing emails have in common covers the warning signs.
• Channels have changed. Texts, phone calls and deepfake video now show up alongside email.
• Phishing-resistant MFA made the difference. Cloudflare stopped the attack that hit Twilio because it used hardware security keys.
• Help desks and vendors are targets. MGM, Target and M&S all involved a third party or support process.
• Process beats instinct. Callback rules and second approvers would have stopped the Facebook, Google and Arup payments.

Social engineering isn’t new. Kevin Mitnick relied on phone pretexting decades ago; read our profile of Kevin Mitnick. For how attackers turn stolen access into money, see how hackers make money.

For new phishing campaigns and scams as they break, the CyberExperts Daily Brief sends a short summary every weekday.

Frequently asked questions

Sources

• FBI Internet Crime Complaint Center, 2025 Internet Crime Report: ic3.gov (PDF)
• IBM, Cost of a Data Breach Report 2026: ibm.com
• KnowBe4, Phishing resource center (history of phishing): knowbe4.com
• ZDNet, Anatomy of the Target data breach: zdnet.com
• BBC, Google and Facebook duped in huge ‘scam’: bbc.com
• FBI, Phishing the Famous: Man Who Targeted Celebrities Sentenced (Oct 15, 2019): fbi.gov
• Twilio, Incident Report: Employee and Customer Account Compromise (Aug 2022): twilio.com
• Cloudflare, The mechanics of a sophisticated phishing scam and how we stopped it: cloudflare.com
• Uber, Security update (Sept 2022): uber.com
• Retool, When MFA isn’t actually MFA (Sept 2023): retool.com
• MGM Resorts, Form 8-K (Oct 5, 2023): sec.gov
• BleepingComputer, MGM Resorts ransomware attack led to $100 million loss, data theft: bleepingcomputer.com
• CISA, Scattered Spider advisory (AA23-320A): cisa.gov
• CNN, Arup revealed as victim of $25 million deepfake scam (May 2024): cnn.com
• Google Threat Intelligence, The Cost of a Call: From Voice Phishing to Data Extortion: cloud.google.com
• BBC, M&S cyber-attack disruption to last until July and cost £300m: bbc.com
• Joseph Blount, testimony to the Senate Homeland Security Committee (June 8, 2021): hsgac.senate.gov (PDF)
• Al Jazeera/Bloomberg, Hackers breached Colonial Pipeline with one compromised password (June 4, 2021): aljazeera.com
• U.S. Department of Justice, Department of Justice Seizes $2.3 Million in Cryptocurrency Paid to the Ransomware Extortionists Darkside (June 7, 2021): justice.gov

Zachary Amos

Zachary is a tech writer and the features editor of ReHack Magazine where he covers cybersecurity and all things technology.