The 17 biggest data breaches of the 21st century

statistics breaches occur every day, in too many locations at once to maintain count number. but what constitutes a huge breach versus a small one? CSO compiled a list of 17 of the largest or most tremendous breaches of the 21^st century.

This checklist is based not necessarily on the variety of information compromised, but on how plenty chance or hurt the breach caused for organizations, insurers and clients or account holders. In some cases, passwords and other counsel have been smartly protected by encryption, so a password reset eliminated the bulk of the chance.

[ How much does a data breach cost? Here’s where the money goes. | Get the latest from CSO by signing up for our newsletters. ]

CSO

1. Yahoo

Date: 2013-14
influence: three billion consumer debts
particulars: In September 2016, the once dominant cyber web tremendous, whereas in negotiations to promote itself to Verizon, introduced it had been the sufferer of the biggest records breach in background, probably by using “a state-backed actor,” in 2014. The attack compromised the precise names, e mail addresses, dates of start and mobilephone numbers of 500 million clients. The company mentioned the “great majority” of the passwords worried had been hashed the use of the mighty bcrypt algorithm.

a couple of months later, in December, it buried that previous record with the disclosure that a breach in 2013, by way of a unique group of hackers had compromised 1 billion bills. anyway names, dates of birth, electronic mail addresses and passwords that were no longer as neatly blanketed as those involved in 2014, security questions and solutions were also compromised. In October of 2017, Yahoo revised that estimate, asserting that, really, all 3 billion consumer money owed had been compromised.

The breaches knocked an estimated $ 350 million off Yahoo’s sale expense. Verizon ultimately paid $ 4.forty eight billion for Yahoo’s core cyber web company. The settlement called for the two corporations to share regulatory and legal liabilities from the breaches. The sale didn’t encompass a stated funding in Alibaba group preserving of $ forty one.3 billion and an possession interest in Yahoo Japan of $ 9.3 billion.

Yahoo, situated in 1994, had once been valued at $ one hundred billion. After the sale, the business changed its name to Altaba, Inc.

study extra in regards to the Yahoo information breach…

2. grownup buddy Finder 

Date: October 2016
influence: greater than 412.2 million accounts
particulars: The FriendFinder community, which included casual hookup and grownup content sites like adult pal Finder, Penthouse.com, Cams.com, iCams.com and Stripshow.com, changed into breached someday in mid-October 2016. Hackers accrued 20 years of statistics on six databases that included names, e-mail addresses and passwords.

lots of the passwords had been blanketed handiest by means of the weak SHA-1 hashing algorithm, which supposed that ninety nine % of them had been cracked by the point LeakedSource.com posted its analysis of the complete statistics set on November 14.

CSO online’s Steve Ragan reported at the time that, “a researcher who goes by using 1×0123 on Twitter and via Revolver in other circles posted screenshots taken on grownup chum Finder (that) reveal a local File Inclusion vulnerability (LFI) being triggered.” He observed the vulnerability, found out in a module on the production servers used through adult chum Finder, “changed into being exploited.”

AFF vp Diana Ballou issued an announcement saying, “We did establish and fix a vulnerability that changed into involving the capacity to entry supply code through an injection vulnerability.”

study more concerning the adult chum Finder facts breach…

3. eBay

Date: might also 2014
have an impact on: one hundred forty five million users compromised
details: The online auction huge stated a cyberattack in can also 2014 that it noted exposed names, addresses, dates of birth and encrypted passwords of all of its 145 million clients. The business referred to hackers bought into the company network using the credentials of three corporate employees, and had complete internal entry for 229 days, throughout which period they were capable of make their way to the user database.

It asked its customers to alternate their passwords, but stated financial tips, akin to bank card numbers, changed into stored one by one and turned into not compromised. The business turned into criticized at the time for a scarcity of conversation informing its users and negative implementation of the password-renewal method.

CEO John Donahue talked about the breach resulted in a decline in consumer endeavor, however had little have an impact on on the base line – its Q2 income was up 13 % and profits up 6 p.c, in accordance with analyst expectations.

study extra concerning the eBay statistics breach…

four. Equifax

Date: July 29 2017

have an impact on: own advice (including Social security Numbers, birth dates, addresses, and in some situations drivers’ license numbers) of 143 million buyers; 209,000 patrons additionally had their credit card data exposed.

particulars: Equifax, probably the most biggest credit score bureaus within the U.S., stated on Sept. 7, 2017 that an utility vulnerability on one of their websites ended in a knowledge breach that exposed about 143 million consumers. The breach become found out on July 29, but the business says that it seemingly started in mid-might also.

study greater concerning the Equifax breach…

5. Heartland charge systems 

Date: March 2008
influence: 134 million credit score cards exposed via SQL injection to installation spyware on Heartland’s records methods.
details: at the time of the breach, Heartland turned into processing a hundred million price card transactions per 30 days for one hundred seventy five,000 retailers – most small- to mid-sized marketers. It wasn’t discovered until January 2009, when Visa and MasterCard notified Heartland of suspicious transactions from money owed it had processed.

among the many consequences were that Heartland turned into deemed out of compliance with the fee Card trade statistics safety regular (PCI DSS) and changed into no longer allowed to technique the payments of foremost credit card providers except can also 2009. The business additionally paid out an estimated $ a hundred forty five million in compensation for fraudulent payments.

A federal grand jury indicted Albert Gonzalez and two unnamed Russian accomplices in 2009. Gonzalez, a Cuban-American, changed into speculated to have masterminded the foreign operation that stole the credit score and debit cards. In March 2010 he became sentenced to twenty years in federal prison. The vulnerability to SQL injection turned into well understood and safety analysts had warned agents about it for several years. Yet, the continuing vulnerability of many internet-facing functions made SQL injection the most usual form of attack against web websites at the time.

examine greater concerning the Heartland facts breach…

6. goal retailers 

Date: December 2013
have an impact on: credit/debit card guidance and/or contact information of as much as a hundred and ten million people compromised.
details: The breach in fact begun earlier than Thanksgiving, however changed into now not found until several weeks later. The retail gigantic firstly introduced that hackers had gained access through a third-birthday party HVAC vender to its aspect-of-sale (POS) fee card readers, and had gathered about forty million credit score and debit card numbers.

via January 2014, although, the business upped that estimate, reporting that in my opinion identifiable assistance (PII) of 70 million of its valued clientele had been compromised. That protected full names, addresses, electronic mail addresses and cellphone numbers. The ultimate estimate is that the breach affected as many as a hundred and ten million shoppers.

target’s CIO resigned in March 2014, and its CEO resigned in might also. The company these days estimated the charge of the breach at $ 162 million.

The company turned into credited with making enormous safety advancements. although, a contract announced in can also 2017 that gave goal one hundred eighty days to make certain security advancements became described via Tom Kellermann, CEO of Strategic Cyber Ventures and former CSO of fashion Micro, as a “slap on the wrist.” He additionally mentioned it, “represents the day prior to this’s protection paradigm,” for the reason that the necessities focal point on maintaining attackers out and not on enhancing incident response.

study extra in regards to the target data breach…

7. TJX agencies, Inc.

Date: December 2006
affect: ninety four million credit score playing cards uncovered.
details: There are conflicting accounts about how this came about. One supposes that a gaggle of hackers took potential of a vulnerable facts encryption system and stole bank card information during a instant transfer between two Marshall’s retailers in Miami, Fla. The other has them breaking into the TJX community through in-store kiosks that allowed individuals to apply for jobs electronically.

Albert Gonzalez, hacking legend and ringleader of the Heartland breach, was convicted in 2010 of leading the crowd of thieves who stole the credit playing cards, and sentenced to 20 years in prison, while 11 others were arrested. He had been working as a paid informant for the united states Secret service, at a $ seventy five,000 profits at the time of the crimes. The government claimed in its sentencing memo that businesses, banks and insurers lost near $ 200 million.

examine greater in regards to the TJX facts breach…

8. Uber

Date: Late 2016
impact: very own information of fifty seven million Uber users and 600,000 drivers exposed.
particulars: The scope of the Uber breach alone warrants its inclusion on this record, and it’s no longer the worst a part of the hack. the manner Uber handled the breach once found out is one massive sizzling mess, and it’s a lesson for other groups on what now not to do.

The company discovered in late 2016 that two hackers had been capable of get names, e mail addresses, and cellular phone numbers of 57 clients of the Uber app. They additionally acquired the driving force license numbers of 600,000 Uber drivers. as far as we recognize, no other records similar to bank card or Social safety numbers had been stolen. The hackers have been capable of access Uber’s GitHub account, where they found username and password credentials to Uber’s AWS account. these credentials should still by no means had been on GitHub.

here’s the basically dangerous half: It wasn’t except a couple of year later that Uber made the breach public. What’s worse, they paid the hackers $ a hundred,000 to smash the information and not using a strategy to examine that they did, claiming it turned into a “computer virus bounty” fee. Uber fired its CSO because of the breach, simply putting the blame on him.

The breach is believed to have cost Uber dearly in each popularity and cash. on the time that the breach turned into introduced, the business become in negotiations to promote a stake to Softbank. at first, Uber’s valuation became $ 68 billion. by the time the deal closed in December, its valuation dropped to $ 48 billion. no longer the entire drop is because of the breach, but analysts see it being a significant component.  

study more in regards to the Uber breach…

9. JP Morgan Chase 

Date: July 2014
impact: seventy six million households and seven million small organizations
particulars: The biggest financial institution within the nation became the sufferer of a hack all over the summer of 2014 that compromised the facts of more than half of all US households – 76 million – plus 7 million small agencies. The statistics included contact counsel – names, addresses, cellphone numbers and electronic mail addresses – in addition to inside assistance in regards to the clients, in response to a filing with the Securities and trade commission. 

The bank noted no consumer money had been stolen and that there became “no evidence that account counsel for such affected purchasers – account numbers, passwords, user IDs, dates of birth or Social safety numbers – was compromised all over this assault.”

nonetheless, the hackers were reportedly able to gain “root” privileges on more than ninety of the bank’s servers, which supposed they could take moves together with transferring money and shutting bills. in accordance with the SANS Institute, JP Morgan spends $ 250 million on security each year. 

In November 2015, federal authorities indicted four men, charging them with the JP Morgan hack plus other economic associations. Gery Shalon, Joshua Samuel Aaron and Ziv Orenstein faced 23 counts, including unauthorized access of computers, id theft, securities and wire fraud and money laundering that netted them an estimated $ one hundred million. A fourth hacker who helped them breach the networks was now not identified.

Shalon and Orenstein, both Israelis, pleaded now not guilty in June 2016. Aaron become arrested at JFK Airport in long island closing December.

examine more in regards to the JP Morgan facts breach…

10. US office of Personnel administration (OPM) 

Date: 2012-14
impact: personal counsel of 22 million existing and former federal employees
particulars: Hackers, noted to be from China, were inner the OPM gadget beginning in 2012, however were no longer detected except March 20, 2014. A 2d hacker, or neighborhood, received entry to OPM through a third-party contractor in may also 2014, but changed into now not found out unless practically a year later. The intruders exfiltrated very own records – including in many cases particular protection clearance guidance and fingerprint facts.

remaining year, former FBI director James Comey pointed out the information contained within the so-called SF-86 form, used for conducting history checks for worker protection clearances. “My SF-86 lists each region I’ve ever lived because i used to be 18, each foreign go back and forth I’ve ever taken, all of my household, their addresses,” he noted. “So it’s now not just my identification that’s affected. I’ve received siblings. I’ve bought 5 youngsters. All of that’s in there.”

A document, released final fall by way of the house Committee on Oversight and executive Reform summed up the hurt in its title: “The OPM statistics Breach: How the executive Jeopardized Our country wide protection for greater than a era.” 

examine greater in regards to the OPM information breach…

11. Sony’s pscommunity 

Date: April 20, 2011
influence: seventy seven million pscommunity debts hacked; estimated losses of $ 171 million whereas the website became down for a month.
particulars: here’s considered as the worst gaming neighborhood information breach of all-time. Of greater than seventy seven million bills affected, 12 million had unencrypted credit card numbers. Hackers won access to full names, passwords, e-mails, domestic addresses, buy heritage, credit card numbers and PSN/Qriocity logins and passwords. “or not it’s enough to make each decent protection adult ask yourself, ‘If here is what or not it’s like at Sony, what’s it like at every other multi-national enterprise it really is sitting on thousands and thousands of person statistics statistics?'” observed eIQnetworks’ John Linkous. He says it is going to remind these in IT security to establish and practice protection controls continually throughout their groups. For shoppers, “be cautious whom you supply your statistics to. it may well no longer be worth the fee to get access to on-line games or other virtual belongings.”

In 2014, Sony agreed to a preliminary $ 15 million contract in a category action lawsuit over the breach.

read more in regards to the Sony data breach…

12. Anthem 

Date: February 2015
impact: Theft of personal tips on up to seventy eight.8 million present and former valued clientele.
particulars: The second-greatest health insurer in the U.S., formerly referred to as WellPoint, said a cyberattack had uncovered the names, addresses, Social protection numbers, dates of beginning and employment histories of current and former valued clientele – every little thing vital to steal identification.

Fortune pronounced in January that a nationwide investigation concluded that a international executive seemingly recruited the hackers who carried out what turned into stated to be the greatest facts breach in healthcare history. It reportedly begun a year earlier than it turned into announced, when a single user at an Anthem subsidiary clicked on a link in a phishing email. the full can charge of the breach isn’t yet favourite, however it is anticipated to exceed $ a hundred million.

Anthem mentioned in 2016 that there was no proof that members’ information were offered, shared or used fraudulently. bank card and medical assistance also allegedly has now not been taken. 

read more about the Anthem records breach…

13. RSA safety

Date: March 2011
have an impact on: possibly 40 million employee facts stolen.
particulars: The impact of the cyberattack that stole information on the safety huge’s SecurID authentication tokens remains being debated. RSA, the protection division of EMC, spoke of two separate hacker agencies worked in collaboration with a foreign government to launch a series of phishing assaults against RSA employees, posing as people the employees depended on, to penetrate the enterprise’s network.

EMC mentioned final July that it had spent as a minimum $ sixty six million on remediation. in accordance with RSA executives, no customers’ networks have been breached. John Linkous, vice president, chief safety and compliance officer of eIQnetworks, Inc. would not purchase it. “RSA did not assist the depend by in the beginning being vague about both the attack vector, and (greater importantly) the records that became stolen,” he says. “It became most effective a remember of time earlier than subsequent assaults on Lockheed-Martin, L3 and others occurred, all of that are believed to be partly enabled by way of the RSA breach.” beyond that become psychological harm. among the training, he talked about, are that even decent security companies like RSA are not resistant to being hacked.

Jennifer Bayuk, an impartial guidance safety consultant and professor at Stevens Institute of know-how, advised SearchSecurity in 2012  that the breach become, “a huge blow to the protection product business as a result of RSA turned into such an icon. They’re the quintessential protection supplier. For them to be some extent of vulnerability changed into a real shocker. I don’t believe any person’s gotten over that,” she pointed out.

examine greater concerning the RSA statistics breach…

14. Stuxnet 

Date: someday in 2010, however origins date to 2005
affect: intended to attack Iran’s nuclear energy software, but will also serve as a template for precise-world intrusion and repair disruption of vigour grids, water components or public transportation systems.
details: The instant effects of the malicious Stuxnet worm had been minimal – at the least in the united states – but numerous consultants rank it among the proper colossal-scale breaches because it became a cyberattack that yielded physical outcomes.

Its malware, designed to target handiest Siemens SCADA methods, damaged Iran’s nuclear program via destroying an estimated 984 uranium enrichment centrifuges. The attack has been attributed to a joint effort with the aid of the united states and Israel, however under no circumstances officially mentioned as such.

study extra about Stuxnet, who created it and why…

15. VeriSign 

Date: during 2010
impact: Undisclosed suggestions stolen
particulars: safety experts are unanimous in saying that probably the most troubling aspect concerning the VeriSign breach, or breaches, wherein hackers received access to privileged systems and suggestions, is the style the company handled it – poorly. VeriSign on no account announced the attacks. The incidents didn’t turn into public unless 2011, after which only via a new SEC-mandated submitting.

As PCWorld put it, “VeriSign buried the guidance in a quarterly Securities and alternate fee (SEC) submitting as if it was just an additional mundane tidbit.”

VeriSign pointed out no important systems such as the DNS servers or the certificates servers were compromised, however did say that, “entry become received to suggestions on a small portion of our computers and servers.” It has yet to record what the tips stolen turned into and what impact it may have on the business or its purchasers.

read greater in regards to the VeriSign facts breach…

sixteen. domestic Depot 

Date: September 2014
influence: Theft of credit/debit card advice of 56 million shoppers.
particulars: The hardware and constructing give retailer introduced in September what had been suspected for some weeks – that starting in April or may additionally, its POS programs had been infected with malware. The business later said an investigation concluded that a “exciting, custom-built” malware had been used, which posed as anti-virus software.

In March 2016, the company agreed to pay as a minimum $ 19.5 million to compensate US buyers via a $ 13 million fund to reimburse purchasers for out-of-pocket losses, and to spend at least $ 6.5 million to fund 1 1/2 years of cardholder id insurance policy services.

The contract covers about forty million people who had charge card information stolen, and greater than 52 million people who had email addresses stolen. There turned into some overlap between the organizations. The company estimated $ 161 million of pre-tax charges for the breach, together with the consumer contract and anticipated insurance proceeds.

study more concerning the domestic Depot information breach…

17. Adobe 

Date: October 2013
have an effect on: 38 million consumer statistics
particulars: at the beginning mentioned in early October by safety blogger Brian Krebs, it took weeks to determine the size of the breach and what it covered. The company at the start suggested that hackers had stolen practically three million encrypted consumer credit card records, plus login facts for an undetermined variety of consumer bills.

Later in the month, Adobe pointed out the attackers had accessed IDs and encrypted passwords for 38 million “active clients.” however Krebs reported that a file posted simply days prior, “appears to include greater than 150 million username and hashed password pairs taken from Adobe.” After weeks of analysis, it eventually grew to become out, as neatly as the supply code of a couple of Adobe products, the hack had additionally uncovered customer names, IDs, passwords and debit and credit card assistance.

In August 2015, an contract referred to as for Adobe to pay a $ 1.1 million in prison charges and an undisclosed quantity to clients to settle claims of violating the client statistics Act and unfair enterprise practices. In November 2016, the quantity paid to purchasers turned into said at $ 1 million.

study greater concerning the Adobe facts breach…

related video:

greater on records breaches:

Cyware News – Latest News