Cybersecurity Attack Almost Cost This IT Leader His Freedom

John Sileo’s story of a cyber threat gone awry was so shocking it became the basis of a Hollywood movie.

What are the worst outcomes that can happen when an organization is hit with a serious cyber threat such as ransomware? The organization takes a financial hit and pays the ransom. Or their cyber insurance covers them and then premiums skyrocket. Perhaps heads roll, and IT executives are dismissed.

John Sileo, a tech entrepreneur, cybersecurity expert and strategist faced a stiff jail sentence after falling victim to a cybersecurity attack and scam. Sileo shared his story during his keynote address at MES’ Midsize Enterprise Summit Fall 2025.

“Tech executives have made a bad business decision at some point in their careers,” Sileo said. But, he asked those in attendance, have you made a bad business decision that led to jail time?

Sileo said he had. “When my doorbell rang early morning Tuesday, August 12, I had no idea I was about to face jail time for cybercrimes that weren't mine and bad decisions that were,” he said.

Prior to that fateful day, Sileo was living the American dream. He had married his childhood sweetheart, had two little girls (his “fireflies” is how he referred to them during his keynote), and he had founded a multimillion-dollar internet company with his best friend, Doug.

Then the bottom fell out.

“Doug and I built a multimillion-dollar internet company that allowed me to spend those precious Tuesdays with my fireflies in valuable days. And that's exactly when an organized cyber [crime team] stole my social security number. Out of some un-shredded trash I'd thrown out. In my case, a woman, Rosemary Serrano, purchased my stolen identity on the dark web and used my pristine credit to buy herself an oceanfront home cross country in Boca Raton, Florida. Mary defaulted on that loan. Declared bankruptcy in my name and drained our life savings.”

“I was about to be charged for electronically embezzling/hacking $298,000 from my own software customers. The [district attorney] now has had enough digital DNA to put me in jail for a decade, and then he left me there, shaking in front of my girls with a cup of tea in my hand. Fast-forward two years through the criminal trial fighting like hell to keep myself out of jail for crimes I had nothing to do with and had to assume was Rosemary's. Our multimillion-dollar software company is gone. The family business,” Sileo said.

“Doug, my best friend and business partner, [a] man I loved and trusted like my brother, stole and used my banking login credentials to fund his sick habits and use my identity to cover his side of crimes.”

While Sileo managed to exonerate his name, those dark days led to several epiphanies about battling cyber threats as well as a movie based on his story — “Identity Theft,” a 2013 film starring Jason Bateman.

Sileo shared his insights about security and business and life, which he said he learned the “really hard way.”

Two Important Cybersecurity Lessons From Sileo For IT Leaders:

‘Create An Organizational Culture Of Security’

“All security is personal first,” he said, beginning at home with how one protects their smartphone and online personal accounts.

“If you don't first connect emotionally to what you have at stake as an individual in this day-to-day, if you don't engage your people to care about their own personal information, you will never create an organizational culture of security.”

‘Train Your People’

“Train your people to protect their own personal information first. If you want to build ownership, give them good personal security habits and the disastrous consequences of ignoring them, like I did,” Sileo advised.

Above all, he urged IT leader to teach end users to be skeptical.

“We have been engineered out of our skepticism, especially the generation below us for freebies, for downloads for access, and so forth. Not just any skepticism, mindful skepticism that knows what to do. That knows how to verify if a transaction is legitimate before they click, before they plug in a USB, before they give answers over the phone. Whatever it might be.”

The AI Threat Is Real

Sileo also discussed the implications of AI in the new cyberthreat arena and the importance of retraining in the AI era.

For cyber criminals, laziness often expedites efficiency. “They automated, just like we have with everything,” he said about hackers.

“Artificial intelligence, ChatGPT, FraudGPT. They're using oxytocin, our trust hormone, to chemically engineer us and our people to give away information, which is the tip of the hacker sphere, and in doing so, they have utilized AI in the same way we have. But this time, they have killed the phishing sniff test.

As proof, look no further than at the “current type of email that we see,” Sileo said. Threat emails “might actually be from the IT provider for this company because they've taken over or they've properly spoofed. [Or may have] a customized relevant subject line that makes the person think, ‘OK, this person knows me.’ It uses casual language, no translation, no grammar, no spelling errors,” he said. “They have used AI to eliminate all of the traditional red flags, and that gives your people permission to click.”

Traditional phishing simulation exercises “aren’t working,” Sileo said.

“People simply click off of them. They don't pay attention. The answer here is to replace that automated training with, if you can, a live engaging multi-use ‘hogwash reflex’ that applies to phishing and farming and business email.”

To arm end users against new AI-fueled threats, “you have to go back and train on updated forms of engineering. Most of our training is behind. It's not accounting for the fact that AI now scales all of this stuff over and over. The phishing emails, the attacks, the phone calls, the zooms, and so forth. It's got to be all forms of communication, not simply just email. Your people are still thinking email and maybe text,” he said.

“Criminals are probably a year ahead. They have no regulations. They get to use it in any way they see,” he added.

Triple-Threat Ransomware

One of the consequences of AI advancement is the evolution of ransomware into what Sileo calls “triple-threat” ransomware.

“External trade and encrypted the data number one. They blackmail you 50 percent of the time, getting some usable form of your data back, and when you pay, then they blackmail you a second time. And promised that they will not share the data publicly. And then, when they've gotten that pain that they go downstream into the data, and they blackmail the individuals that are making up that customer data,” he said.

“What is it in your life, in your business that is so very important,” Sileo asked the audience to examine.

“What is priceless to you? What is priceless to your organization? Because that is what we must identify and defend first. What are the stakes if you make mistakes?” he said.