Alex Holden

Alex Holden (born November 5, 1974) is the owner of Hold Security, a computer security firm. As of 2015, the firm employs 16 people.

Life In 1979, when Holden was five years old, Holden's family was denied permission to emigrate to the United States from Soviet Ukraine; this may have resulted in persecution for attempting to leave. However, seven years later the Chernobyl nuclear disaster led to mass evacuations, allowing the family to flee to Moldova, moving next to Italy, and finally the United States. In Italy, at 14, he missed a year of school to work in a farm. Holden later attended, but did not graduate from, the University of Wisconsin–Milwaukee. At the age of 27, Holden became the chief information security officer of Robert W. Baird & Co., a Milwaukee-based financial-services company that manages more than a hundred billion dollars of assets. Hold Security came into existence in February 2013, when a small security company called Cyopsis split in two.

Notable investigations

U.S. Internet Email Exposure In February 2024, Holden discovered that U.S. Internet had exposed more than a decade of internal and customer email communications through a publicly accessible server, affecting more than 6,500 organizations, including businesses, educational institutions and government agencies. He also identified abuse of the company's URL protection service to redirect users to malicious websites. After Holden notified KrebsOnSecurity, U.S. Internet removed the exposed data and began an internal investigation.

Killnet In 2024, Holden investigated the Russian hacktivist group Killnet, documenting the group's decline, identifying links between its leadership and the Russian darknet marketplace Solaris, and identifying its leader, KillMilk, as Nikolay Serafimov. The investigation formed the basis of a Forbes Ukraine report examining the group's collapse and internal structure.

Solaris In late 2022, Holden infiltrated the Russian darknet marketplace Solaris, obtaining administrative access to portions of its infrastructure, including its cryptocurrency exchange. During the operation, 1.6 bitcoin from Solaris' master wallet was redirected to a Ukrainian humanitarian charity, a transfer independently confirmed by Forbes. Holden later released technical findings documenting Solaris' infrastructure and its links to the pro-Russian hacktivist group Killnet.

Trickbot Developer Alla Witte In 2021, Holden published an investigation into alleged Trickbot developer Alla Witte, documenting her operational security failures and activities within the ransomware group. The investigation was subsequently cited by KrebsOnSecurity in its coverage of Witte's arrest and the group's recruitment practices.

Glovo Breach In May 2021, Holden identified evidence that hackers had gained unauthorized access to the internal systems of the Spanish delivery company Glovo, including customer and courier accounts. After Holden shared the findings with Forbes, Glovo confirmed the breach, secured the affected systems and notified Spain's data protection authority.

Oxford University Laboratory Breach In February 2021, Holden alerted Forbes to a cyber intrusion affecting systems at the University of Oxford's Structural Biology Laboratory (Strubi), providing evidence that attackers had accessed laboratory systems used in biochemical research. Oxford University subsequently confirmed the incident and notified the National Cyber Security Centre.

Hospital Ransomware Attacks In October 2020, Holden warned that cybercriminals affiliated with the Ryuk ransomware group were preparing coordinated attacks against more than 400 U.S. hospitals. He shared the intelligence with the FBI, after which the FBI, the Department of Homeland Security, and the Department of Health and Human Services issued a joint warning about an imminent ransomware threat targeting healthcare providers.

Yahoo Breach Before Yahoo publicly disclosed the breach in 2016, revealing that more than 500 million user accounts had been compromised in what was then the largest known corporate data breach, Holden tracked the circulation of stolen Yahoo credentials on underground forums and marketplaces. His investigation helped establish the timeline of the breach by tracing how the stolen data first surfaced under the aliases "Tessa88" and "Peace of Mind".

POS Vendor Breaches In August 2016, Holden's firm discovers evidence leading to breach of Oracle’s MICROS POS along with a number of other victims. Discovery details the indicators of compromise of MICROS and other victims and potential data that could have been stolen from them.

2016 Alleged Email Credentials Cache In 2016, Holden claimed to have uncovered a major cache of 272 million unique email addresses along with the passwords to their webmail accounts. Holden's news release was criticized when subsequent investigation by the webmail providers showed that almost none of the passwords were valid.

97 Dating Websites Breached During the summer of 2015, Russian hackers breached 97 websites mostly made up of dating sites. Ashley Madison, the most prominent of these sites, had sensitive company information, emails, internal documents, and details of 30 million users stolen in this breach. Holden's firm were the ones who discovered the stolen information which they found on a server the hackers were using.

JP Morgan Breach In the summer of 2014, JPMorgan Chase was attacked by a gang of Russian hackers who stole information compromising 76 million households and seven million small businesses. Holden and his firm were crucial in helping discover this intrusion uncovering a billion of passwords and usernames that the gang had stolen.

2014 Russian Hackers

In 2014, Holden and his firm discovered that a group of Russian hackers possessed 542 million stolen email addresses with 1.2 billion email-and-password combinations, the largest cache of stolen credentials discovered to date.

CorporateCarOnline Breach In November 2013, Holden's firm discovered that the limousine software-as-a-service company CorporateCarOnline had been hacked exposing credit card and personal information of nearly 1 million customers. Some of these customers include politicians, star athletes, and corporate executives. But, there were no indications that any of the information the hackers stole was abused in any way afterwards.

Adobe Systems Breach Holden worked with cybersecurity journalist Brian Krebs to alert Adobe of the 2013 Adobe data breach, a theft of 2.9 million customer accounts and of the source code to some of Adobe's products. Adobe Systems publicly acknowledge the breach thanking Holden and Krebs for incident discovery.

PR Newswire Breach In October 2013, the same hackers that breached Adobe earlier that year did the same to PR Newswire. This group of hackers stole the usernames and encrypted passwords of the marketing and press release distribution service's customers. Holden and his firm were vital in the discover of this breach and the analysis of the stolen data from PR Newswire.

LexisNexis, Dun & Bradstreet, HireRight/Kroll, and NW3C Breach In 2013, popular data brokers like LexisNexis and the non-profit organization National White Collar Crime Center (NW3C) were compromised when operations of the underground criminal identity theft service was discovered. Hackers compromised systems within LexisNexis, Dun & Bradstreet, HireRight/Kroll, and NW3C stealing data and information. Holden and his firm were instrumental in discovering and analyzing the attack servers and breaches.