"What an Apology Email Teaches": 58 Cyber Terms and How Incidents Unfold

The article uses the technical terms that appear in actual "apology emails" as clues to trace step by step where an incident starts and what happens. It first explains the differences in expressions such as "unauthorized access," "personal information," and "information leakage," and how first reports and follow-up reports are handled, clarifying why the full picture is often unknown at the time of the initial notice.

It then explains the concept of vulnerabilities (CVE, CVSS, KEV, zero-day), the importance of patches, issues with end-of-support products, and the mechanism of responsible disclosure. As entry points it lists VPN device vulnerabilities, leaked IDs/passwords, password-list attacks and phishing, supply-chain attacks via contractors, and prompt injection attacks targeting generative AI.

Regarding post-intrusion activity, it covers malware, privilege escalation, lateral movement, the susceptibility of Active Directory, the role of C2 servers, and ransomware encryption combined with data theft in "double extortion," as well as the division of labor in RaaS. The article cites National Police Agency figures for the first half of 2026, stating that "VPN devices were the most common ransomware entry route, accounting for about 50%."

It also touches on types of leaked information (sensitive personal data, hashed passwords, and the practice of not retaining card information), the handling of leak sites and the dark web, and the risk of secondary harm. Finally, it explains the roles of CSIRT, SOC, EDR, logs, containment, and forensic investigations, and provides the technical rationale for phrasing such as "there is a possibility that data was leaked."