The recent discovery of a publicly available Elasticsearch cluster, a group of interconnected search servers, containing 24 billion exposed records, is among the largest-scale data breaches, highlighting the troubling reality that passwords have become a weak link in modern digital security.
For years, one of the responses to cyberthreats has been to create stronger passwords, implement password rotation policies, and deploy password managers. Despite all these efforts, credential-related attacks continue to dominate the threat landscape.
The latest threat is a reminder that the problem is not simply password hygiene – but the password itself.
The Weaknesses of Password-Based Security
Passwords were designed for a simpler era of computing. Today, passwords are used to protect everything from corporate networks and cloud applications to banking platforms and healthcare systems. Even with the evolution in computing, the basic principle of passwords remains unchanged. That is, access is granted on a secret that can be stolen, guessed, reused, or shared.
The 24 billion record leak demonstrates the scale of this vulnerability. This means cybercriminals now possess records of usernames, email addresses, login URLs and passwords that can be weaponized against organizations.
The password challenge is made worse by human behavior. Users often reuse passwords across multiple accounts, use predictable combinations, or rely on slight variations of existing credentials. This means a breach affecting one platform can easily become a gateway to many others.
Unfortunately, organizations continue to invest heavily in securing networks, endpoints and applications while still relying on an authentication mechanism that is failing to withstand today’s threat environment.
Why Traditional Defenses Are No Longer Adequate
The greatest danger that arises from a big password leak is credential stuffing attacks. In these attacks, cybercriminals systematically test stolen username and password combinations across thousands of websites and applications using automated tools. Since users frequently reuse credentials, attackers can achieve high success rates with minimal effort. The credential stuffing attacks model allows threat actors to compromise accounts without exploiting software vulnerabilities or bypassing sophisticated security controls.
Even password managers, although valuable, are not the best solution. They help users generate and store stronger credentials, but are not immune to phishing attacks, session hijacking, malware-based credential theft, or social engineering attacks.
Multi-factor authentication (MFA) improves security. However, attackers have increasingly taken advantage of MFA fatigue attacks, SIM-swapping, and real-time phishing proxies.
Simply put, organizations are investing significant resources to protect a flawed authentication model.
Passwordless Authentication: The Next Evolution of Identity Security
The business impact of credential compromise has far-reaching consequences. The solution today is not the use of stronger passwords – but instead, reducing dependence on them altogether.
Passwordless authentication promises more secure methods that are resistant to phishing, credential theft, and reuse attacks. Several technologies are emerging as a replacement for traditional credentials.
Passkeys A passkey is a fast identity online (FIDO) authentication credential where, instead of typing a secret word, a user device confirms who they are using built-in security. An example is when you log in to a Google account, and your phone simply asks for your fingerprint or face scan.
Biometric Authentication This adds another layer of convenience and security. It includes fingerprint scans, facial recognition, and other biometric identifiers. These allow users to authenticate using characteristics that are unique to them rather than information they must remember.
Hardware Security Keys This provides another powerful option. It involves the use of physical devices such as YubiKeys or Google Titan Security Keys that authenticate users through public-key cryptography. Because the private key never leaves the device, it provides strong protection against phishing and credential theft and is widely considered among the most effective defenses against account compromise.
Despite the advantages of these passwordless methods, adoption remains low. Many organizations continue to operate legacy systems designed around traditional username and password models. It is worth noting that the integration of modern authentication frameworks does require significant planning and investment. However, it should be considered as an evolution that requires strategic commitment rather than a quick fix.
Final Thoughts
The recent exposure of 24 billion records is more than another headline-grabbing cybersecurity incident. It is evidence that the password-centric model of digital security is no longer secure. This should prompt organizations still using the traditional password methods to adopt passwordless authentication.
As technology advances, new security challenges will arise, including the emergence of quantum computing and the need for quantum-resistant cryptography. These developments reinforce the lesson that security cannot remain static. The goal is not to predict every future threat, but to build security architectures that evolve with technology.
Alan F Burke CPA
Beyond Passwords: Why Recent 24B Records Leak is Wake-Up Call for Stronger Authentication
July 1, 2026 · Blog, What's New in Technology
⏱ 4 min read
The recent discovery of a publicly available Elasticsearch cluster, a group of interconnected search servers, containing 24 billion exposed records, is among the largest-scale data breaches, highlighting the troubling reality that passwords have become a weak link in modern digital security.
For years, one of the responses to cyberthreats has been to create stronger passwords, implement password rotation policies, and deploy password managers. Despite all these efforts, credential-related attacks continue to dominate the threat landscape.
The latest threat is a reminder that the problem is not simply password hygiene – but the password itself.
The Weaknesses of Password-Based Security
Passwords were designed for a simpler era of computing. Today, passwords are used to protect everything from corporate networks and cloud applications to banking platforms and healthcare systems. Even with the evolution in computing, the basic principle of passwords remains unchanged. That is, access is granted on a secret that can be stolen, guessed, reused, or shared.
The 24 billion record leak demonstrates the scale of this vulnerability. This means cybercriminals now possess records of usernames, email addresses, login URLs and passwords that can be weaponized against organizations.
The password challenge is made worse by human behavior. Users often reuse passwords across multiple accounts, use predictable combinations, or rely on slight variations of existing credentials. This means a breach affecting one platform can easily become a gateway to many others.
Unfortunately, organizations continue to invest heavily in securing networks, endpoints and applications while still relying on an authentication mechanism that is failing to withstand today’s threat environment.
Why Traditional Defenses Are No Longer Adequate
The greatest danger that arises from a big password leak is credential stuffing attacks. In these attacks, cybercriminals systematically test stolen username and password combinations across thousands of websites and applications using automated tools. Since users frequently reuse credentials, attackers can achieve high success rates with minimal effort. The credential stuffing attacks model allows threat actors to compromise accounts without exploiting software vulnerabilities or bypassing sophisticated security controls.
Even password managers, although valuable, are not the best solution. They help users generate and store stronger credentials, but are not immune to phishing attacks, session hijacking, malware-based credential theft, or social engineering attacks.
Multi-factor authentication (MFA) improves security. However, attackers have increasingly taken advantage of MFA fatigue attacks, SIM-swapping, and real-time phishing proxies.
Simply put, organizations are investing significant resources to protect a flawed authentication model.
Passwordless Authentication: The Next Evolution of Identity Security
The business impact of credential compromise has far-reaching consequences. The solution today is not the use of stronger passwords – but instead, reducing dependence on them altogether.
Passwordless authentication promises more secure methods that are resistant to phishing, credential theft, and reuse attacks. Several technologies are emerging as a replacement for traditional credentials.
Passkeys A passkey is a fast identity online (FIDO) authentication credential where, instead of typing a secret word, a user device confirms who they are using built-in security. An example is when you log in to a Google account, and your phone simply asks for your fingerprint or face scan.
Biometric Authentication This adds another layer of convenience and security. It includes fingerprint scans, facial recognition, and other biometric identifiers. These allow users to authenticate using characteristics that are unique to them rather than information they must remember.
Hardware Security Keys This provides another powerful option. It involves the use of physical devices such as YubiKeys or Google Titan Security Keys that authenticate users through public-key cryptography. Because the private key never leaves the device, it provides strong protection against phishing and credential theft and is widely considered among the most effective defenses against account compromise.
Despite the advantages of these passwordless methods, adoption remains low. Many organizations continue to operate legacy systems designed around traditional username and password models. It is worth noting that the integration of modern authentication frameworks does require significant planning and investment. However, it should be considered as an evolution that requires strategic commitment rather than a quick fix.
Final Thoughts
The recent exposure of 24 billion records is more than another headline-grabbing cybersecurity incident. It is evidence that the password-centric model of digital security is no longer secure. This should prompt organizations still using the traditional password methods to adopt passwordless authentication.
As technology advances, new security challenges will arise, including the emergence of quantum computing and the need for quantum-resistant cryptography. These developments reinforce the lesson that security cannot remain static. The goal is not to predict every future threat, but to build security architectures that evolve with technology.
Disclaimer
These articles provide general information on tax, accounting, and financial topics for small businesses and individuals. They are educational in nature and are not specific legal, accounting, financial, tax, or other professional advice, and should not be relied upon as such. This content was prepared by Service2Client and may have been reviewed or edited by the website owner for accuracy and compliance. Look for a trust mark below for verification details. No representation is made that any approach described will achieve a particular result, and no regulatory or professional body has reviewed or endorsed this content. Because each situation is different, readers should consult a qualified professional about their specific circumstances before acting. Images accompanying these articles are protected by copyright and may not be copied or reused.
Horizontal Analysis provides businesses a method to examine financial statement entries by looking at the documents’ number for a specific accounting time frame compared to the same length of a historical period for the same accounting line item.
Breaking the Process Down
It’s a way to measure trends and variances by looking at the current year’s values versus the reference year. This helps an analyst figure out if the values increase or decrease. It’s either done on an absolute value or a percentage change basis. The analysis provides a company’s growth and financial position against competitors.
This method is different compared to vertical analysis because vertical analysis looks at a single reporting period and measures the proportional relationship between items, compared to horizontal analysis evaluating multiple periods and multiple ratios for a more comprehensive approach.
Generally Accepted Accounting Principles (GAAP) require uniform and standardized financial statements for adequate financial statement analysis. This entails consistent accounting practices and fundamental principles being employed annually. Comparability constraints mandates that the business’ financial statements are in a form that permits analysts to evaluate them against other competitors in the same field. This is where horizontal analysis comes into play, creating consistency.
This analysis determines what impacts a company’s growth over time. For cyclical or seasonal companies, it lets analysts get a handle on what’s normal and what’s not. It also permits identification of variances in different product/business segments and how to project a company’s future performance.
Along with the three financial statements (balance sheet, cash flow statement, and income statement) providing working outcomes, it can similarly identify issues and strengths by looking at certain metrics like profit margins or the rate of inventory changing hands.
If a company reports higher earnings per share due to increases in revenue or lowers its figures of the COGS (cost of goods sold), analysts looking at the interest coverage ratio or cash flow-to-debt ratio, for example, can use horizontal analysis to gauge if a business has enough liquidity for continued operations.
Real World Example of Horizontal Analysis
Let’s say Company X had revenue of $100 million in the previous year and accounts receivable of $200 million during the “base year.” This is compared to revenue of $300 million in the present year and accounts receivable of $600 million. Based on these numbers, the calculations are as follows:
Revenue Comparison
[($300 million – $100 million)/$100 million)] x 100 = 200 percent
Accounts Receivable
[($600 million – $300 million)/$300 million)] x 100 = 100 percent
When it comes to interpreting horizontal analysis, the process needs context to ensure it’s used appropriately. The most prominent consideration is understanding what contributed to the base year’s numbers and the current year’s numbers. Did the company sell off a segment that increased profitability, or did they face massive lawsuits or spend excessive amounts of capex to ensure their viability and competitiveness in the upcoming years?
The calculation is straightforward, but being able to delve into what happened – and why – is the role of the business owner and investor to determine the true health of the business.
Alan F Burke CPA
Understanding Horizontal Analysis
June 1, 2026 · Blog, General Business News
⏱ 3 min read
Horizontal Analysis provides businesses a method to examine financial statement entries by looking at the documents’ number for a specific accounting time frame compared to the same length of a historical period for the same accounting line item.
Breaking the Process Down
It’s a way to measure trends and variances by looking at the current year’s values versus the reference year. This helps an analyst figure out if the values increase or decrease. It’s either done on an absolute value or a percentage change basis. The analysis provides a company’s growth and financial position against competitors.
This method is different compared to vertical analysis because vertical analysis looks at a single reporting period and measures the proportional relationship between items, compared to horizontal analysis evaluating multiple periods and multiple ratios for a more comprehensive approach.
Generally Accepted Accounting Principles (GAAP) require uniform and standardized financial statements for adequate financial statement analysis. This entails consistent accounting practices and fundamental principles being employed annually. Comparability constraints mandates that the business’ financial statements are in a form that permits analysts to evaluate them against other competitors in the same field. This is where horizontal analysis comes into play, creating consistency.
This analysis determines what impacts a company’s growth over time. For cyclical or seasonal companies, it lets analysts get a handle on what’s normal and what’s not. It also permits identification of variances in different product/business segments and how to project a company’s future performance.
Along with the three financial statements (balance sheet, cash flow statement, and income statement) providing working outcomes, it can similarly identify issues and strengths by looking at certain metrics like profit margins or the rate of inventory changing hands.
If a company reports higher earnings per share due to increases in revenue or lowers its figures of the COGS (cost of goods sold), analysts looking at the interest coverage ratio or cash flow-to-debt ratio, for example, can use horizontal analysis to gauge if a business has enough liquidity for continued operations.
Real World Example of Horizontal Analysis
Let’s say Company X had revenue of $100 million in the previous year and accounts receivable of $200 million during the “base year.” This is compared to revenue of $300 million in the present year and accounts receivable of $600 million. Based on these numbers, the calculations are as follows:
Revenue Comparison
[($300 million – $100 million)/$100 million)] x 100 = 200 percent
Accounts Receivable
[($600 million – $300 million)/$300 million)] x 100 = 100 percent
When it comes to interpreting horizontal analysis, the process needs context to ensure it’s used appropriately. The most prominent consideration is understanding what contributed to the base year’s numbers and the current year’s numbers. Did the company sell off a segment that increased profitability, or did they face massive lawsuits or spend excessive amounts of capex to ensure their viability and competitiveness in the upcoming years?
The calculation is straightforward, but being able to delve into what happened – and why – is the role of the business owner and investor to determine the true health of the business.
Disclaimer
These articles provide general information on tax, accounting, and financial topics for small businesses and individuals. They are educational in nature and are not specific legal, accounting, financial, tax, or other professional advice, and should not be relied upon as such. This content was prepared by Service2Client and may have been reviewed or edited by the website owner for accuracy and compliance. Look for a trust mark below for verification details. No representation is made that any approach described will achieve a particular result, and no regulatory or professional body has reviewed or endorsed this content. Because each situation is different, readers should consult a qualified professional about their specific circumstances before acting. Images accompanying these articles are protected by copyright and may not be copied or reused.
Here’s something that flew under the radar for most people: a court decision from late last year could put money back in your pocket if you got hit with IRS penalties during COVID. But you need to act fast! For some taxpayers, the deadline to file a claim is July 10.
What This Case Is Actually About
Remember when COVID was declared a federal disaster? That designation wasn’t just symbolic. It triggered real protections under the tax code, specifically Section 7508A, which lets the IRS push back deadlines and waive penalties when taxpayers are caught up in a disaster. We’re talking about failure-to-file and failure-to-pay penalties here, and those fees can add up to almost 50 percent of what you already owe, which is brutal!
The Kwong v. United States decision came down from the Court of Federal Claims in November 2025, and it changed the game. The court said the nationwide COVID emergency created a mandatory postponement running from Jan. 20, 2020, through July 10, 2023. Everything that came due in that window should have been bumped to July 11, 2023. In other words, a lot of people may have been penalized when they shouldn’t have been.
This Got Real on April 30
The case had been percolating quietly until the National Taxpayer Advocate (NTA) made some noise about it on April 30. That’s when things got interesting. According to the NTA, tens of millions of taxpayers could be eligible for refunds. Not just on the penalties themselves, but on the interest that piled up on top of those penalties.
The NTA isn’t being shy about this either. The office has pushed hard for the IRS to apply relief broadly instead of making people jump through hoops. They want systemic fixes, not case-by-case battles. And they’ve asked Congress to make sure procedural red tape doesn’t rob people of money they are owed.
There’s another wrinkle worth knowing about. Some refunds issued during 2020 through 2023 may have shortchanged taxpayers on interest because the IRS treated their returns as late. If Kwong holds up, you might be able to claim that missing interest, too.
Expats Had It Especially Rough
If you were living overseas when the pandemic hit, you know the chaos was next level. Borders slammed shut with no warning. People got stranded in countries they were just passing through. Others couldn’t get back to the places they’d been living for years.
Good luck reaching your accountant when consulates are closed, mail isn’t moving, and you’re dealing with a 12-hour time zone difference. Some folks couldn’t access their bank accounts. Others couldn’t get basic documents. And plenty of people were simply stuck, unable to go anywhere, when their filing deadlines rolled around.
Slapping penalties on taxpayers who were dealing with all of that? It misses the point entirely. The disaster relief rules exist for exactly these situations. The NTA has been clear: fair treatment means recognizing what people were actually going through.
You Need to File a Protective Claim
Here’s the practical part. If you want to preserve your right to get this money back, you have to file something called a protective claim. Think of it as a placeholder that keeps your options open while the legal dust settles.
For many people, the deadline is July 10, 2026, though it depends on the tax year involved. Don’t wait until the last minute to figure this out.
The good news is the paperwork isn’t complicated. You can use IRS Form 843 or just file an amended return. You need to list the tax years you’re claiming and note that your refund depends on how the Kwong case plays out. You don’t have to calculate the exact dollar amount right now. The whole point is just to get yourself on record before time runs out.
A Few Limitations to Know About
This relief is specifically about federal income taxes under the Internal Revenue Code. If you’re worried about Report of Foreign Bank and Financial Accounts (FBAR) penalties, that’s a different animal. FBARs fall under the Bank Secrecy Act, so Kwong doesn’t automatically help there. That said, you might still have a reasonable cause argument based on the same COVID disruptions.
State taxes? Every state did its own thing. Most offered some pandemic extensions, but those programs were separate and usually more limited than what we’re talking about here.
Conclusion
If there’s any chance this applies to you, file that protective claim now. Especially if you were overseas during the pandemic years. Once that deadline passes, the door closes for good.
Alan F Burke CPA
The IRS Could Owe You Money Thanks to a Pandemic-Era Court Ruling
June 1, 2026 · Blog, Tax and Financial News
⏱ 4 min read
Here’s something that flew under the radar for most people: a court decision from late last year could put money back in your pocket if you got hit with IRS penalties during COVID. But you need to act fast! For some taxpayers, the deadline to file a claim is July 10.
What This Case Is Actually About
Remember when COVID was declared a federal disaster? That designation wasn’t just symbolic. It triggered real protections under the tax code, specifically Section 7508A, which lets the IRS push back deadlines and waive penalties when taxpayers are caught up in a disaster. We’re talking about failure-to-file and failure-to-pay penalties here, and those fees can add up to almost 50 percent of what you already owe, which is brutal!
The Kwong v. United States decision came down from the Court of Federal Claims in November 2025, and it changed the game. The court said the nationwide COVID emergency created a mandatory postponement running from Jan. 20, 2020, through July 10, 2023. Everything that came due in that window should have been bumped to July 11, 2023. In other words, a lot of people may have been penalized when they shouldn’t have been.
This Got Real on April 30
The case had been percolating quietly until the National Taxpayer Advocate (NTA) made some noise about it on April 30. That’s when things got interesting. According to the NTA, tens of millions of taxpayers could be eligible for refunds. Not just on the penalties themselves, but on the interest that piled up on top of those penalties.
The NTA isn’t being shy about this either. The office has pushed hard for the IRS to apply relief broadly instead of making people jump through hoops. They want systemic fixes, not case-by-case battles. And they’ve asked Congress to make sure procedural red tape doesn’t rob people of money they are owed.
There’s another wrinkle worth knowing about. Some refunds issued during 2020 through 2023 may have shortchanged taxpayers on interest because the IRS treated their returns as late. If Kwong holds up, you might be able to claim that missing interest, too.
Expats Had It Especially Rough
If you were living overseas when the pandemic hit, you know the chaos was next level. Borders slammed shut with no warning. People got stranded in countries they were just passing through. Others couldn’t get back to the places they’d been living for years.
Good luck reaching your accountant when consulates are closed, mail isn’t moving, and you’re dealing with a 12-hour time zone difference. Some folks couldn’t access their bank accounts. Others couldn’t get basic documents. And plenty of people were simply stuck, unable to go anywhere, when their filing deadlines rolled around.
Slapping penalties on taxpayers who were dealing with all of that? It misses the point entirely. The disaster relief rules exist for exactly these situations. The NTA has been clear: fair treatment means recognizing what people were actually going through.
You Need to File a Protective Claim
Here’s the practical part. If you want to preserve your right to get this money back, you have to file something called a protective claim. Think of it as a placeholder that keeps your options open while the legal dust settles.
For many people, the deadline is July 10, 2026, though it depends on the tax year involved. Don’t wait until the last minute to figure this out.
The good news is the paperwork isn’t complicated. You can use IRS Form 843 or just file an amended return. You need to list the tax years you’re claiming and note that your refund depends on how the Kwong case plays out. You don’t have to calculate the exact dollar amount right now. The whole point is just to get yourself on record before time runs out.
A Few Limitations to Know About
This relief is specifically about federal income taxes under the Internal Revenue Code. If you’re worried about Report of Foreign Bank and Financial Accounts (FBAR) penalties, that’s a different animal. FBARs fall under the Bank Secrecy Act, so Kwong doesn’t automatically help there. That said, you might still have a reasonable cause argument based on the same COVID disruptions.
State taxes? Every state did its own thing. Most offered some pandemic extensions, but those programs were separate and usually more limited than what we’re talking about here.
Conclusion
If there’s any chance this applies to you, file that protective claim now. Especially if you were overseas during the pandemic years. Once that deadline passes, the door closes for good.
Disclaimer
These articles provide general information on tax, accounting, and financial topics for small businesses and individuals. They are educational in nature and are not specific legal, accounting, financial, tax, or other professional advice, and should not be relied upon as such. This content was prepared by Service2Client and may have been reviewed or edited by the website owner for accuracy and compliance. Look for a trust mark below for verification details. No representation is made that any approach described will achieve a particular result, and no regulatory or professional body has reviewed or endorsed this content. Because each situation is different, readers should consult a qualified professional about their specific circumstances before acting. Images accompanying these articles are protected by copyright and may not be copied or reused.
The recent discovery of a publicly available Elasticsearch cluster, a group of interconnected search servers, containing 24 billion exposed records, is among the largest-scale data breaches, highlighting the troubling reality that passwords have become a weak link in modern digital security.
Horizontal Analysis provides businesses a method to examine financial statement entries by looking at the documents’ number for a specific accounting time frame compared to the same length of a historical period for the same accounting line item.
Here’s something that flew under the radar for most people: a court decision from late last year could put money back in your pocket if you got hit with IRS penalties during COVID. But you need to act fast! For some taxpayers, the deadline to file a claim is July 10.