---
title: "Discussion on \"Before the 115 Charges Against Man City, There Was One Phishing Email\" | Hashnode"
description: "Discussion on \"Before the 115 Charges Against Man City, There Was One Phishing Email\". Before the verdict, before the appeal, there was one phishing email in 2017. Here's how it happened — and the cybersecurity lesson every organization should take from it."
url: "https://hashnode.com/posts/before-the-115-charges-against-man-city-there-was-one-phishing-email/6ac356b593fac4039279ceac"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Before the 115 Charges Against Man City, There Was One Phishing Email](https://sixtusphere.hashnode.dev/before-the-115-charges-against-man-city-there-was-one-phishing-email?utm_source=hashnode&utm_medium=feed)

Before the verdict, before the appeal, there was one phishing email in 2017. Here's how it happened — and the cybersecurity lesson every organization should take from it.

Oct 5 · 7 min read · sixtusphere.hashnode.dev  
Read the article

-   [#cybersecurity](https://hashnode.com/tag/cybersecurity)
-   [#phishing](https://hashnode.com/tag/phishing)
-   [#security](https://hashnode.com/tag/security)
-   [#law](https://hashnode.com/tag/law)
-   [#corporate-security](https://hashnode.com/tag/corporate-security)

## Written by

[Sixtus Sphere](https://hashnode.com/@sixtusphere)

@sixtusphere · Anambra, Nigeria

  
[View profile](https://hashnode.com/@sixtusphere)

Founder of Sixtusphere — cybersecurity, simplified.

Cybersecurity student at UniNiger and founder of Sixtusphere, a cybersecurity digital agency. Writing about practical security concepts — the kind that actually matter, not just the buzzwords.

## Responses 2

Markdown supported · ⌘↵ to post

[indiainfranotes](https://hashnode.com/@indiainfranotes)

[Oct 5](https://hashnode.com/posts/before-the-115-charges-against-man-city-there-was-one-phishing-email/6ac356b593fac4039279ceac/comment/6ac36bb28247e4b882099f8e)

Great reframing: the verdict everyone is arguing about traces back to one link that "looked like Tuesday". The detail I would add is that the click was only step one; the bigger failure was that one official's session could reach thousands of internal documents without anything flagging the bulk access. Phishing-resistant MFA like passkeys would have blunted the click, but access logging would have caught the exfiltration. If you had to pick one control for a mid-size club today, would it be passkeys or alerts on bulk document access?

iin1005h1428

[Sixtus Sphere](https://hashnode.com/@sixtusphere)

[Oct 5](https://hashnode.com/posts/before-the-115-charges-against-man-city-there-was-one-phishing-email/6ac356b593fac4039279ceac/comment/6ac36bb28247e4b882099f8e#reply-6ac3f672b00cee8f5a08501a)

Good add, you're right that the click was only the entry point, the real failure was that nothing flagged one account suddenly pulling thousands of documents. If I had to pick one control for a mid-size club today, I'd lean toward alerts on bulk document access over passkeys alone. Passkeys stop THIS specific attack (credential phishing), but they don't stop an already-authenticated account from being used to exfiltrate data, whether that's through a compromised session, an insider, or malware on the device. Anomaly detection on access patterns catches a wider range of ways this could go wrong, not just phishing. Ideally you'd want both, but if budget forces a choice, I'd protect the data movement, not just the login.