Brian Krebs

Brian Krebs is an American investigative journalist and blogger specializing in computer security, cybercrime, and information security. He founded and operates the blog Krebs on Security and has reported extensively on data breaches, cybercriminal forums, carding operations, and emerging threats. His work has influenced law enforcement, corporate security practices, and public awareness across the technology and media sectors.

Early life and education

Born and raised in the United States, Krebs studied communications and journalism before entering the technology beat. He attended institutions and programs associated with journalism training and communication studies while developing an early interest in computer security and information technology through personal projects and community engagements. Early influences include reporting traditions from outlets like The Washington Post, The New York Times, and technology-focused publications such as Wired (magazine) and PC Magazine. Networking with professionals from Symantec, McAfee, and academic researchers at institutions like Carnegie Mellon University and Massachusetts Institute of Technology further shaped his focus on cybersecurity reporting.

Career

Krebs began his professional career in newsroom environments, contributing to regional and national media organizations including The Washington Post and technology sections tied to major outlets. He transitioned to full-time independent reporting with the launch of Krebs on Security, establishing a presence among specialized publications such as Dark Reading, SC Magazine, and Threatpost. Over time he has interacted with vendors and platforms like Microsoft, Google, Amazon (company), and security firms including Trend Micro, Kaspersky Lab, and FireEye (now Trellix). His investigative workflow often involves coordination with law enforcement agencies such as the Federal Bureau of Investigation, the Department of Justice (United States), and international partners including Europol and national cybercrime units. He has spoken at conferences like Black Hat (conference), DEF CON, RSA Conference, and academic symposia at Stanford University and Harvard University.

Notable investigations and reporting

Krebs reported on numerous high-profile incidents and actors, covering breaches affecting organizations such as Target Corporation, Home Depot, Equifax, Sony Pictures Entertainment, and Yahoo!. He investigated criminal marketplaces and forums like CarderPlanet, ShadowCrew, and modern equivalents operating on the Dark web and through services tied to TOR (anonymity network). His coverage exposed operations involving payment card fraud, distributed denial-of-service campaigns, and botnets including variants related to Mirai (malware). Krebs's reporting on compromised point-of-sale systems, credential-stuffing attacks, and massive data leaks intersected with reporting on incidents such as the 2007 cyberattacks on Estonia, the 2014 JPMorgan data breach, and subsequent incidents examined by cybersecurity firms like Mandiant and CrowdStrike. He also detailed takedowns of cybercriminal infrastructures in cooperation with law enforcement stings that involved actors targeted under statutes like the Computer Fraud and Abuse Act and cross-border investigations coordinated through mechanisms such as INTERPOL.

Cybersecurity impact and advocacy

Through Krebs on Security, he contributed to raising public and industry awareness about vulnerabilities in critical platforms and the economics of cybercrime. His work influenced corporate disclosure practices at companies like Equifax (company), Yahoo!, Target Corporation, and Home Depot and informed regulatory and legislative discussions in venues including the United States House Committee on Energy and Commerce and the European Commission. Krebs advocated for stronger breach notification, improved incident response, and adoption of defenses promoted by entities such as the National Institute of Standards and Technology and the Cybersecurity and Infrastructure Security Agency. His reporting informed threat intelligence sharing among private firms and consortia like ISACs and prompted security improvements at technology providers including Cisco Systems and Fortinet.

Awards and recognition

Krebs's investigative reporting has been recognized by industry and journalism organizations. He has received awards, commendations, and citations from bodies including the Electronic Frontier Foundation, cybersecurity trade media like SC Magazine and InfoWorld, and journalism associations connected to outlets such as The Washington Post and ProPublica. His blog has been cited in academic research at universities such as Carnegie Mellon University and University of California, Berkeley, and his investigative pieces have been referenced in congressional hearings and policy discussions involving agencies like the Federal Trade Commission and Department of Homeland Security.

Category:American journalists Category:Cybersecurity