Explore the biggest data breaches and leaks in the 21st century, from CAM4 to Yahoo issues.
Every company is at risk of a data breach or leak. Stealing personal data or sensitive information might be a highly profitable business for hackers and cybercriminals and a problem for companies.
Over the years, data breaches and leaks have increased exponentially. The number of exposed records in Q1 2020 was 273% higher than in 2019.
People seem to have become desensitized to news of millions or billions of stolen data records. There’s general data-breach fatigue around cybersecurity failures.
- Why have we become so unbothered?
- How do data breaches and leaks happen, and how extensive can their impact be?
Let’s find that out by exploring our list of the top 5 data breaches and leaks over the last few years.
How do data breaches and leaks happen?
You may be used to hearing about data breaches and leaks, but you need to understand how they happen. That’s why data is one of the most valuable assets for companies.
Experts call data the new oil because it is equivalent to knowledge, which is crucial to informed decision-making.
People sometimes use the terms data breach and data leak interchangeably, but they refer to different things.
Data Breach
A data breach occurs when an external actor gains access to restricted information, for example, through social engineering attempts. It is a deliberate attack aimed at stealing data.
Data Leak
Data leakage occurs when a company or organization fails to implement adequate security practices, leaving data exposed. This exposure can be accidental or intentional.
Example: Facebook and the Cambridge Analytica data scandal, where employees intentionally leaked information to draw outside attention.
What are the consequences of data breaches and leaks?
The outcomes of a data breach or leak can include:
- Leakage of confidential information
- Destruction of databases
- Intellectual property theft
- Breach of compliance with regulations
- Heavy legal requirements, depending on the jurisdiction and type of data involved.
The consequences for businesses that experience a data breach are increasing and becoming more severe as regulations evolve.
Companies are no longer just required to announce that their systems have been breached.
To decide if an administrative fine will be imposed and the amount of said fine according to the General Data Protection Regulation (GDPR) Art.83 (2), the following aspects must be considered:
- “The nature, gravity, and duration of the infringement, taking into account the nature, scope, or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them.”
- “The intentional or negligent character of the infringement.”
- “Any action taken by the controller or processor to mitigate the damage suffered by data subjects.”
According to GDPR Art. 83 (5), for more severe violations:
- “Infringements of the following provisions shall, by paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher”.
Such heavy penalties underscore the need for companies to prevent these incidents. When they happen, companies must take adequate measures to prevent further losses.
One of the most common burdens for companies, especially those that operate internationally, is determining where their customers reside to identify which regulatory authority has jurisdiction. Then, they notify their customers and must comply with requirements in each jurisdiction.
The regulations define which data requires notification after a breach, who must be notified, how it is carried out, and whether specific authorities must be notified.
The costs of the notification process, along with legal penalties, potential compensation for damages, and even lawsuits, can be enough to drive companies into bankruptcy, even if the attack hadn’t already caused it, as was the case with Code Spaces.
A data breach or leak can expose your business model and strategies to competitors who might steal your unique advantage. Also, consider the impact of data scandals on the company’s reputation, which can affect deals like the purchase of Yahoo by Verizon.
Even though end-users aren’t typically the direct target of cybercriminals who want to steal sensitive information (given some exceptions like ransomware), they can be affected when their data records are caught in a breach or leak.
So, even though there isn’t much that end-users can do to avoid getting caught in a data incident, they can still take some cautionary steps:
- With financial data involved, notify their bank, verify account details, and change any PIN codes or passwords.
- Be extra careful with incoming emails since cybercriminals can pose as real entities. Plus, they should not click on anything coming from unknown sources.
- Check if the company has assistance programs for fraud or identity theft victims.
- Watch for class-action lawsuits against the breached company and check whether you qualify for compensation.
Now that we’ve covered the key concepts of a data breach, it’s time to look at our list of the top 5 data breaches and data leaks over the years.
Top 5 data breaches and leaks
1. CAM4: Data leak
In March 2020, the adult video streaming website CAM4 leaked 10.88 billion records. Among the leaked records, there was sensitive information containing full names, email addresses, sexual orientation, chat transcripts, email correspondence transcripts, IP addresses, password hashes, and payment logs.
Plus, because many exposed email addresses were linked to cloud storage services, attackers who accessed the data and successfully executed phishing attacks could gain further access to personal photos and business information.
Overall, because of its nature, this data leak could lead to compromised users being targeted in future blackmail attempts.
2. Aadhaar: Data breach and leak
According to the World Economic Forum’s (WEF’s) Global Risks Report 2019, Aadhaar suffered multiple breaches that potentially compromised the data of 1.1 billion people.
The personal information of the affected citizens stored on the world’s largest biometric database was even up for sale online.
Cybercriminals were selling access to the database for 10 minutes for 500 rupees. Furthermore, in March 2018, there was a leak on a system run by a state-owned utility company involving more data.
The incidents exposed information such as unique 12-digit identity numbers, bank details, photographs, thumbprints, retina scans, and other identifying details.
Aadhaar was developed with the goal of reducing bureaucracy and fraud, but due to its security faults, it ended up threatening the individual privacy of its users. It is the perfect example to show that you don’t just need a new solution for a problem; you also need to adequately develop a threat model for that solution and adopt the required security controls to prevent data breaches and keep users’ data secure.
3. Yahoo: Data breach
This incident is still one of the biggest we have seen. It happened between 2013 and 2014, but Yahoo didn’t announce it until 2016.
First, it was believed the attackers had obtained data from 500 million users; then that number grew to 1 billion users; and eventually, in 2017, Yahoo revised the estimate to 3 billion users. The stolen data included names, email addresses, dates of birth, and telephone numbers.
Although no plain-text passwords or financial information were stolen, this is one of the most significant breaches to date.
The announcement of the breach happened at a time when Yahoo was in the process of being acquired by Verizon. This ended up benefiting from the $350 million drop in the value of the company.
4. First American Financial Corporation: Data leak
In May 2019, First American Financial Corporation reported a leak that compromised 885 million users.
This leak included sensitive user data such as banking account records, Social Security numbers, transactions, mortgage paperwork, and more. The information dates back over 16 years, and no authentication was required to read the documents. This shows that even old records can be compromised if companies don’t take preventive measures to secure data.
The company has stated that the data leak originated from a “design defect” on its website. However, in these situations, it’s hard to pinpoint the exact effects because there is no evidence of an external attacker accessing the files, which doesn’t mean it didn’t happen.
Due to the nature of the exposed data, since the disclosure of the incident, the company has found itself drawn into a variety of lawsuits, including a class action lawsuit.
5. Marriott International: Data breach
The incident was reported in 2018. The company stated that hackers had stolen the data of around 500 million Starwood hotel customers. Marriott International acquired Starwood in 2016, but attackers had accessed Starwood’s system as early as 2014.
The compromised data included names, contact information, passport numbers, travel information, and other personal data.
Marriott also believes attackers stole the credit card numbers and expiration dates of more than 1,000 million customers. However, they are uncertain whether the attackers were able to decrypt the information.
Eventually, this breach was attributed to a Chinese intelligence group looking to gather information on US citizens. Because the breach happened before the UK left the EU, the ICO investigated on behalf of all EU authorities as the lead supervisory authority under the GDPR.
The ICO ultimately fined Marriott £18.4 million for failing to keep its customers’ data safe.
Honorable mention: British Airways (Data Breach)
We couldn’t finish this list without making an honorable mention of the British Airways Magecart data breach.
This attack happened in 2018 and was undetected for more than two months, allowing the attacker to potentially access the personal data of around 429,612 customers and staff.
Amongst this data were names, addresses, payment card numbers, and CVV numbers.
The web-skimming cybercriminal collective known as Magecart led the execution of this attack. Their activities typically involve covertly injecting the web skimmer into the target website through a third-party service such as a chatbot. A strategy that is known as a web supply chain attack.
The ICO ended up fining British Airways £20 million in October 2020 for this event, and the process is still ongoing as of 2021.
Magecart web skimming attacks are still mostly unaddressed, as companies are only now beginning to understand how to address them.
Conclusion
There were many other data breaches that could have made our list, but nonetheless, we hope this provided a useful overview of what is a growing global problem.
The rapid digital transformation in business will only continue to magnify these incidents, and without a robust approach to cybersecurity, businesses will continue to fall victim to cyberattacks.
With regulations advancing and becoming stricter when it comes to user protection, companies need to act now.
Gaining visibility and control is crucial when it comes to being compliant and keeping their users safe.
One key step to consider if your company develops or distributes web and mobile applications is protecting the source code of these apps. Start protecting your code with a Jscrambler free trial.
