Data breaches have a devastating impact on the victims, be they individuals, organizations, or governments. Essentially, they could lead to severe financial losses, legal consequences, reputational damage, privacy loss, or even a threat to national security. Making matters worse, cybercriminals are devising more sophisticated techniques to steal data. So, you should be careful with storing and protecting your data, as its loss could be detrimental.
This article provides a detailed discussion of the biggest breaches worldwide, how they happen, types of data breaches, data breach targets, damages, and much more.
Quick list of the biggest data breaches since 2000
- Yahoo: Breach happened in 2013-2014 affecting 3 billion user accounts, but remained undetected over the following three years.
- Aadhaar: Hackers managed accessing sensitive details of over 1.2 billion registered Indians and selling it on WhatsApp groups.
- LinkedIn: The professional networking service exposed the data of around 700 million users to criminal hackers.
- Sina Weibo: The Chinese social media giant exposed personal information of 538 million users to the hackers who exploited the platform’s API.
- Facebook: Though it has had numerous security breaches in history, the most devastating incident happened in 2019, affecting 533 million users.
- Marriott International (Starwood): The hotel giant exposed sensitive personal and financial information of 500 million customers to the hackers.
- FriendFinder: The dating site suffered a hack in 2016, exposing sensitive data of over 400 million customers.
- MySpace: The incident gained attention after the hackers put the data of over 360 million MySpace users for sale on the dark web.
- Adobe: Hackers not only stole Adobe products source code, but also exfiltrated the naes and account credentials of over 150 million users.
- Equifax: The business faced severe criticism and backlash following the 2017 security breach that affected 147 million users.
- eBay: From the two data breaches it suffered, eBay’s 2014 hack was a serious one that impacted 145 million customers.
- Canva: The Aussie graphics design service exposed the data of 139 million users to the attackers, who then posted the data on the dark web.
- Capital One: The incident gained traction after the attackers confirmed stealing personal and financial information of over 106 million customers.
- JP Morgan Chase: The incident affected household consumers and the small companies alike, as the attackers exploited the stolen data for identity frauds.
- Uber: The popular commuting service paid $100k to the attackers to delete the stolen data of about 57 million Uber users.
- Home Depot: The hackers infected the firm’s payment system with a malware to steal data of over 56 million customers.
- Target Stores: Hackers accessed the vendors POS to steal personal and financial data of about 40 million customers.
What is a data breach?
A data breach refers to an incident in which private information or protected data is accessed, utilized, or disclosed without authority from persons holding the information. A data breach can happen due to user behavior or weaknesses in the technology used to store the information and may result in legal, financial, and reputation damages.
In this light, a data breach may occur through a cyberattack, improper disposal of data, or accidental data leaks. When such happens, a range of private information is exposed, including names, email addresses, social security numbers, credit card information, and location.
Types of data breaches
The following are common types of data breaches:
1. Ransomware
Cybercriminals encrypt your file or device and demand a ransom to restore access or otherwise infect, delete or release the data to the public. Ransomware can spread quickly through an entire network and could lead to serious data loss.
2. Malware
Cybercriminals target your device and install a malicious program into your device. The program infects the system allowing the hacker to manipulate or steal your data.
3. Phishing
Under this type of data breach, hackers send fake emails or messages that appear legitimate and trick you into revealing sensitive data such as credit card information or login details.
4. Denial of Service (DoS)
Denial of service (DoS) involves flooding a system with attacks to manipulate it. These attacks overload the system’s traffic making it inaccessible to legitimate users.
5. Cross-site scripting (XSS) attack
Under this attack, the hacker injects malicious code into your website, allowing them to steal private information such as login details, infect your device, or redirect you to a phishing website.
6. SQL injection attack
It entails injecting malicious code into a website’s Structured Query Language (SQL) database. Cybercriminals insert malicious code into a database query to gain unauthorized access or manipulate the stored data.
7. Man-in-the-Middle attack
Abbreviate as MITM, this type entails the hacker intercepting the communication process between two parties and disguising themself to be the other party. The cybercriminal acts as a relay, sending information between the two parties and gaining access to sensitive information.
8. Physical data breach
Cybercriminals physically access your systems or devices, such as a laptop or external HDD, and steal sensitive information.
9. Insider threat
Employees or other insider persons with access to private information intentionally or unintentionally expose sensitive data.
10. Password guessing/Brute force
Hackers attempt to crack a user’s password by trying many possible combinations. These attempts can be physical or automated using software tools that run thousands of possible combinations.
11. Recording keystrokes
Cybercriminals use strategies such as keyloggers to track and record what you type on your device’s keyboard. Hardware and software keyloggers run in the background and record the typed keys. Consequently, hackers use it to gain sensitive information, such as login details.
12. Eavesdrop attacks
The hacker intercepts communication transmitted over an unsecured network. Cybercriminals gain access to private data via the sniffing attack.
The damage a data breach can do
Data breaches can have a devastating impact on individuals, entities, or the government:
Individuals
Loss of personal information such as social security number, email address, and phone number can cause serious financial, reputational, and legal consequences to individuals.
Organizations
A data breach in an organization can cause serious harm. Loss of protected data such as user information, financial information, or secret business deals can harm the firm’s reputation, financial position, and even competitive advantage.
Government
The loss of highly confidential government information threatens the nation’s security and international position. A data breach can expose military operations, economic data, political information, and other data key to a nation’s stability.
17 biggest security breaches in history
Here are some of the most devastating data breaches in the 21st century:
1. Yahoo
The Yahoo! data breaches happened in 2013 and 2014 and affected 3 billion accounts. The breaches were not discovered until 2016, when Yahoo disclosed that users’ private data, including names, email addresses, dates of birth, and security questions and answers, had been compromised by cybercriminals.
The company faced multiple lawsuits and regulatory investigations due to the breaches. In addition, the incident saw a significant drop in the company’s value to $350 million.
2. Aadhaar
In 2018, a group of hackers gained access to the personal and biometric data of more than 1 billion Indians registered with the nation’s Aadhaar national identification system. Names, addresses, phone numbers, fingerprints, and 12-digit Aadhaar identification numbers of each enrollee, were among the personal data lost to hackers.
The data was sold for as little as $7 through WhatsApp groups. The Indian government received criticism for the insufficient security measures to protect the personal information of the Aadhaar enrollees.
3. LinkedIn
In 2012, nearly 700 million LinkedIn user accounts had their names, email addresses, and passwords compromised due to the data breach. The hackers stole the login information through a third-party website.
Afterward, LinkedIn invalidated the leaked passwords and contacted the impacted members to request new passwords. The corporation came under fire for failing to encrypt user passwords and for not alerting customers of the hack for several days.
4. Sina Weibo
Sina Weibo is a Chinese social media platform that is likened to Twitter. The Sina Weibo incident of 2019 affected more than 538 million accounts leading to the loss of private data, including usernames, gender, location, official names, and phone numbers.
The attacker exploited Sina Weibo API in the hack, enabling them to compare contacts with the address book accessible via the API endpoint. User data was sold on the data web for about $250.
5. Facebook
Facebook has had several data breaches, with the most recent one being in 2019. In this incident, over 533 million users were affected, gaining access to their personal information, including phone numbers and locations. The company was able to identify and fix the vulnerability, but user data had already been compromised.
6. Marriott International
The reservation system at Starwood, a Marriott-owned hotel company, was impacted by the data breach in 2018. In the hack, names, postal addresses, phone numbers, email addresses, passport numbers, and credit card information was exposed, along with the personal and financial data of over 500 million visitors.
It was thought that hackers working for the Chinese government were responsible for the breach, which was not found for four years. However, Marriott was heavily criticized for how it handled the breach and was the subject of many investigations and legal actions following the event.
7. Adult Friend Finder
In 2016, over 412 million accounts on the adult dating website had their personal information compromised in the Adult FriendFinder data breach. Names, email addresses, passwords, and more private data like sexual preferences and if individuals were interested in extramarital affairs were among the personal information that the hackers stole.
The event had serious repercussions for the business, including the CEO’s departure, and it generated questions about the security of user information on dating services.
8. MySpace
The MySpace data breach occurred in 2013, leading to over 360 million users losing private data. A sale advert of the data was put up on the dark web for 6 BTC (about 3,000 at the time). The lost data included names, email addresses, and passwords. MySpace invalidated all user passwords and required users to authenticate and reset their profiles.
9. Adobe
The 2013 Adobe data leak where hackers stole names, email addresses, encrypted passwords, and the source code for various Adobe products. The compromise was found after the hackers posted the stolen source code online and made the personal data of over 150 million customers available for purchase on the dark web.
Legal fees amounting to $1.1 million were incurred following the breach. In addition, the security of the personal data kept by software businesses and source code breaches were also a concern.
10. Equifax
The 2017 Equifax data breach was a cyberattack that breached the confidential information of 147 million, including names, social security numbers, birth dates, addresses, and financial information. The data breach was not noticed for many months after the hackers gained access to the data by taking advantage of a flaw in the company’s website software.
Significant repercussions from the incident for the business included lawsuits, regulatory inquiries, and the resignation of several top executives. Additionally, it sparked calls for more regulation in the sector and worries about the privacy and security of personal information stored by credit reporting organizations.
11. eBay
There were two significant data breaches at eBay, one in 2014 and the other in 2018. The 2014 data breach affected 145 million customers after eBay’s corporate network was compromised. Hackers obtained access to a database comprising user names, email addresses, physical addresses, and dates of birth. The hackers gained access to the company’s database using the login information of three eBay workers.
A far lesser number of users—roughly 1.5 million—were impacted by the 2018 data leak. During the incident, the cybercriminals gained access to a database that contained people’s names, email addresses, and physical addresses. As a precaution, eBay encouraged vulnerable users to change their passwords.
12. Canva
The popular graphics designing service Canva also suffered a terrible data breach in 2019, marking one of the biggest security lapses of the decade.
The incident surfaced online when the firm admitted an “in-progress attack” after a group of hackers, “GnosticPlayers,” claimed the attack’s responsibility.
The breach impacted 139 million Canva users, leaking their usernames, real names, email addresses, physical addresses, and even password hashes for some accounts.
13. Capital One
The incident took place in 2019 and affected over 106 million customers. Various personal information, including names, addresses, phone numbers, and credit card information, was stolen by cybercriminals when they gained access to the company’s payment card system. The breach was uncovered when a hacker claimed responsibility for the breach and put the stolen data online.
14. JP Morgan Chase
Around 76 million households and 7 million small companies compromised their private data by the JP Morgan Chase data breach in 2014. The hackers obtained names, addresses, phone numbers, account numbers, and email addresses. At the time, the occurrence was one of the biggest ever recorded. Data lost in the incident was used for identity theft and money laundering.
15. Uber
Over 57 million Uber customers’ and drivers’ personal information was compromised in the 2016 Uber data breach. Around 600,000 driver’s license numbers, names, email addresses, and mobile phone numbers were stolen by cybercriminals. The breach wasn’t identified until a year later when Uber reported paying the hackers $100,000 to delete the data they had obtained and conceal the incident.
After the incident, Uber’s net worth dropped to $48 billion from $68 billion, prompting its sale to Softbank.
16. Home Depot
The Home Depot incident occurred in 2014, resulting in the loss of credit and debit card information of more than 56 million customers. The cybercriminals infiltrated the company’s card payment system using custom-built malware. The following year, Home Depot agreed to a financial settlement for the damages arising from the breach.
17. Target Stores
Over 40 million customers’ personal and financial information was compromised in the 2013 Target data breach. The hackers took various personal information, including names, addresses, phone numbers, and credit card information, when they gained access to Target’s HVAC vendors’ POS system.
The incident has multiple consequences, including $162 million in losses and the resignations of the CEO and CIO.
What is targeted in data breaches?
While cybercriminals use a wide range of styles to gain access to private information, there’s usually a pattern during the attacks. Hackers identify weak points and exploit them to access your device and data. Here are some common targets of data breaches:
- Weak credentials
Most hackers rely on weak credentials, such as easy-to-guess password combinations, to access sensitive information.
- Stolen data
Stolen credentials are a threat to your privacy and security. If hackers gain access to your stolen credentials, you’re at risk of an attack.
- Compromised programs
Cybercriminals target compromised assets, such as software tools normally meant to protect your device.
- Credit/ Debit Card Fraud
Hackers target credit/debit cards to obtain card information such as card numbers and CVV. Additionally, cybercriminals use methods such as card skimming to read card information whenever the owner swipes on a PDQ or ATM.
- Third-party access
Despite using all privacy and security tools to protect yourself, some attacks might arise from third-party access, such as insiders.
- Mobile devices
Devices carried by employees to the workplace can act as the initial point of the attack. Unsecure devices install malware-laden applications that hackers use to access work emails and files.
How do data breaches happen?
Some common ways how data breaches happen include:
- Accidental data leaks: An employee viewing information unauthorized can be considered a data breach.
- A malicious insider: An individual intentionally accesses private information to cause damage.
- Lost/ stolen devices: A USB drive, laptop, or external HDD containing sensitive data might be in the wrong hands.
- Malicious outsiders: Includes cybercriminals who use various techniques, such as phishing, malware, and SQL injection, to gain unauthorized access to sensitive information.
How to prevent data breaches?
1. Limited access to sensitive data
Implementing strict access control measures such as biometric access helps protect your sensitive information. Furthermore, data classification and separation ensure that only authorized personnel access data based on their clearance level.
2. Compliance by third-parties
Ensuring strict compliance measures are in place is paramount in preventing data breaches. All third parties should abide by the regulations of the data owner to avoid the risks of a data breach.
3. Employee security awareness training
Training employees on security awareness and best practices are crucial to protecting sensitive data. Such training teaches workers how to recognize and prevent various security threats, such as malware, phishing, man-in-the-middle, etc., on the premises.
4. Regular software and security updates
To protect yourself from data breaches, ensure all your programs, including OS and security software, are up-to-date. Security patches on newly updated programs are key to data protection. Software updates come with performance improvements, bug fixes, and security patches that are integral in addressing key vulnerabilities that might facilitate data breaches.
5. Cyber breach response plan
A cyber breach response plan details a step-by-step guide on what to do during a data breach. Having such a plan helps de-escalate the incident, thus preventing further damage. The plan should include a list of experts, procedures, and measures, a communication plan, and a review and update process to ensure it remains effective.
6. Strong passwords
Create strong passwords for all accounts and use different passwords for different profiles to avoid password guessing. Strong passwords should be long, complex, and unique and should not include obvious patterns such as consecutive numbers.
7. Remote monitoring
Ensure you have monitoring tools in place 24/7 to detect and respond to any data threat on your network. The method allows you to monitor system and device safety in real-time, which can help identify, troubleshoot, and respond to any issues quickly and efficiently.
8. Data encryption, backup, and recovery
Data encryption encodes information. Parties who wish to decrypt the data must use a decryption key. The method protects sensitive information from unauthorized personnel and ensures data confidentiality. Further, performing regular backups is important as it allows data recovery in the event of a data breach or loss.
9. Proper data disposal
Proper data disposal is paramount in protecting sensitive information. To protect private information, you must identify the appropriate disposal method, which information you need to dispose of, and follow appropriate disposal procedures. Further, regularly monitor the disposal process to ensure its correctly and securely done.
10. Hire experts
You might consider hiring an expert to protect you from data breaches. Experts can be human or non-human form. The human form entails human experts such as data security specialists, while the non-human includes software-based tools such as antivirus software and encryption tools. Both play an important role in protecting you from data breaches.
11. Protect physical and portable devices
To protect physical and portable devices, ensure that you store data securely and use passwords if possible. Similarly, try your best to store any physical records in a restricted area and away from potential damage. Enable security features such as data encryption and password protection on portable storage devices such as external hard disks.
