7 biggest data breaches in the history of the internet
In this article, we will take a closer look at the biggest data breach incident that affected billions of internet users and ruined the organizations' reputations. 7 min read
Data breaches are one of the worst things that can happen to an organization. In most cases, a lawsuit follows the data breach, also losing customers’ trust ruins the reputation of the organization. The never-ending battle between hackers and cybersecurity experts getting more intense each year and still, thousands of organizations are falling victim to such attacks, reminding us of the importance of cybersecurity. Before starting our list, we should mention different forms of data breach attacks. Depending on the attackers’ goal, data breach attacks can have different effects on organizations. The most common method is contacting the organization after stealing the data to extort money. Hackers threaten organizations to leak stolen data if their demands are not met. However, hackers can still leak the data even if the company pays the requested amount. In some cases, if hackers aim to ruin the organization’s reputation, they can leak the data in a criminal forum for free. Hackers can also sell stolen data to other hacker groups or other partners. The stolen data can be used in phishing attacks. Another common method is called a double extort ransomware attack. It is a combination of data breaches and ransomware. In double extort attacks, hackers not only encrypt the organization’s data, leaving the organization inoperable but also steal the data. Even if the organization can restore the encrypted data, hackers can threaten it by leaking the stolen data. Table of Contents
Impacted: 3 billion
Stolen data: Names, phone numbers, security questions and answers, password recovery emails, cryptographic values unique to each account
Yahoo! was one of the most popular websites on the web in the internet’s early years. However, it lost its popularity during the last decade. One of the main reasons for this downfall is an incident that was revealed in 2016. In September 2016, Yahoo! announced that in a state-sponsored hacking incident, more than 500 million users’ information had been breached in 2014. A few months later, the company had to admit another data breach incident that took place in August 2013, and estimated that 1 billion users were affected by the incident. It was already the biggest data breach incident until that date, but it became worse. FBI got involved in the investigation and revealed that 3 billion Yahoo! accounts had been compromised. The hackers behind the incident were Latvian Alexey Belan and Canadian Karim Baratov, hired by Russia’s Federal Security Service. Their main targets were Russian journalists, Russian cybersecurity company employees, and other Russian officials. The duo managed to gain access to the networks by sending a series of spear-phishing emails with a download link to Yahoo! employees. By creating a back door on the server they could easily download another copy of the entire database in 2014. As a result, the company has agreed to create a fund worth $117,500,000 to compensate users. Baratov was sentenced to 5 years in prison, along with a $2.25 million fine. Belan could never be captured or faced trial. Aadhar
Impacted: 1.1 billion
Stolen data: Names, addresses, photos, phone numbers, emails, biometric data, unique bank accounts connected with the 12-digit ID number
Aadhar, the world’s largest ID database, the data breach was one of the biggest cybersecurity incidents that affected the entire population of one of the world’s biggest countries. Aadhaar, established by the Unique Identification Authority of India in 2009, was created to contain information of over 1.1 billion Indians, which includes a 12-digit unique identity number and biometric data, such as fingerprints, iris scans along with name, gender, and contact information. Although an Aadhaar card wasn’t mandatory, it was required for many bureaucratic processes, including buying a SIM card or creating a bank account. In January 2018, the first news about the data breach of Aadhar was published. Reports revealed that hackers managed to infiltrate the system by using the website of Indane, a state-owned utility company. Investigations revealed that Indane API, which is connected to the government database directly, had no access controls. The flaw was discovered by Karan Saini, a New Delhi-based security researcher, who notified the organization. However, Aadhar denied the allegations. The Indian government also denied storing bank information but the data breach revealed that citizens’ bank accounts connected to their unique 12-digit ID numbers were stored. As a result, all citizens faced the threat of becoming a victim of identity theft. For a long time after the incident, hackers sold citizens’ personal information on Whatsapp groups or other platforms for $7 per person. Some hackers also offer to print fake Aadhaar cards with stolen information. First American Financial Corporation
Impacted: 885 million
Stolen data: Social security numbers, driver’s license images, bank account numbers and statements, mortgage and tax documents, wire transaction receipts
Financial organizations are on top of the hackers list when it comes to breach data. One of the U.S.’ largest title insurance providers, First American Financial Corporation was also targeted by attackers hackers and it even didn’t require any technical expertise to gather the data from the company’s website. The flaw was discovered and announced by Brian Kerbs, an independent security journalist. A real estate developer noticed that the company’s website was leaking records and anyone who know the URL of a document on the website could view it by only changing a digit in the link. The developer tried to contact the company but didn’t get any response and then decided to contact Krebs. Krebs wrote a blog post about the situation and as expected it went viral. Shortly after the company took down some parts of its website and made an announcement about the incident. The company described the flaw as “a design defect in the web application that may or may not have had an effect on the security of customer information.” However, New York’s Department of Financial Services took it more seriously and started an investigation into the security flaw. The U.S. Securities and Exchange Commission is also investigating the situation but no results are published yet. Customers accused the company of failing to implement even rudimentary security measures and filed class-action lawsuits. Verification.io
Impacted: 800 million
Stolen data: Names, email addresses, social media data, addresses, phone numbers, gender, birth dates, company names, company’s annual revenue figures, company website, company’s industry identifiers, fax numbers
Another big data breach that took place in 2019 was the Verifications.io data breach, a big data email verification platform. The service allows marketing companies to verify email addresses that are used in advertising campaigns. Due to the nature of its business, the company had a huge database of email addresses and users. Luckily for the company, the leak was discovered by two white-hat cybersecurity researchers, Bob Diachenko, and Vinny Troia. The duo discovered an unprotected MongoDB including 150 GB of data completely open to the public internet. Researchers notified the company shortly after the discovery and the database was taken down immediately and the company deactivated its website. Shortly after the incident, a free breach notification service, Have I Been Pwned started warning impacted users about the breach. Diachenko stated that a large number of records were very detailed. The company claimed that they could secure the database quickly and said “Goes to show, even with 12 years of experience you can’t let your guard down.” The website remained offline since the incident occurred. Although the database didn’t include any credit card information, social security numbers, or passwords, it is believed that leaked information was used to launch phishing attacks. Equifax
Impacted: 605 million
Stolen data: Name, date of birth, social security number, address, gender, phone number, driver’s license number, email address, taxpayer ID, driver’s license, passport photo, credit card information
The Equifax data breach was one of the biggest ones in terms of both the sensitive information that got leaked and the number of people it affected. Also, the company’s slow approach made it worse. It took six weeks for Equifax to make a public announcement after realizing the breach. During the incident, Equifax executives sold lots of company stock, which caused suspicions. In March 2017, a forensic analysis revealed that hackers exploited a vulnerability in the customer complaint module of the website, which was patched three days before the incident. Equifax’s staff’s slow response to patching the system led to one of the biggest data breaches in internet history. Interestingly, the IT staff ran multiple scans to discover vulnerabilities and unpatched software but somehow scans couldn’t find the problems. In May 2017, the attackers moved from the compromised servers to the entire network, enabling them to steal data by using another flaw. Analysis showed that the company was 10 months late renewing the public key certificate to decrypt, analyze, and re-encrypt data pulled from the internal network. Thus, hackers managed to steal terabytes of data unnoticed. The company became aware of the incident in July 2017 and finally, the company informed the public in September. It resulted in the theft of 605 million records that belongs to 147 million U.S. citizens. A study claimed that 40% of the population’s information was exposed. 200,000 individuals among them also suffered a credit card breach. Affected individuals filed class action lawsuits and the company had to pay a total of $700 million to damaged parties. Facebook
Stolen data: Likes, comments, reactions, account names, Facebook IDs, photos, check-ins, events, unencrypted passwords
For more than a decade, Facebook managed to be one of the most popular social media platforms on the internet. It still has billions of active monthly users and gathers and stores huge amounts of data from its users. Also, it is not the first time Facebook experiences a data breach. In an unrelated incident in 2012, another breach revealed that Facebook left millions of passwords unencrypted on the servers, which were accessible to 20,000 employees. Facebook’s 2019 data breach was also caused by the company’s lack of security measures. Cybersecurity experts from UpGuard discovered two databases on Amazon’s cloud service. One of the publicly accessible and available to download databases belonged to a company named Cultura Colectiva, and the other one belonged to a Facebook-integrated app, At the Pool. Investigators contacted Cultura Colectiva and At the Pool. Cultura Colectiva didn’t respond to the researchers’ emails and the team contacted AWS to inform them about the situation. The database belonging to At the Pool was taken down during the team investigation. The information that was available to the public can be used by other hackers in social engineering attacks. Although Facebook has been sued on multiple occasions due to user privacy violations, no legal action has been taken about the data breach that took place in 2019. Marriott
Stolen data: Names, gender, email addresses, phone number, addresses, passport numbers, credit card information
The Marriott data breach, one of the world’s largest chains of hotels, shows that cybersecurity should be a priority for all organizations in various fields. The lack of necessary security measures also increased the impact of the incident. Although the hackers behind the attack are still unknown, since Marriott is the main provider for U.S. government and military officials, many believe that Chinese state-sponsored actors might be behind the attack. The data breach was discovered in late 2018 when someone made a suspicious attempt to access the guest reservation system. Within days, the company hired third-party investigators and implemented containment measures. Shortly after, investigators managed to discover the cause of the data breach. Attackers used a trojan, along with Mimikatz, which attempts to find combinations of usernames and passwords. By using the credentials of a system administrator, hackers made a suspicious database query, which is caught by Accenture. The database also included encrypted credit card numbers, however, the encryption keys were stored on the same server. Also, some of the passport numbers were encrypted while some were not. The stolen information didn’t appear on the dark web for sale so far, thus investigators believe that the main purpose of attackers was gathering information about U.S. officials. The expenses of the incident were borne by the insurance company mostly. The incident cost $72 million to Marriott and the insurance policy covered $71 million of it. However, the company was issued a $120 million fine by the UK Information Commissioner’s office, but it has yet to pay. Also affected guests filed class action lawsuits that didn’t resolve yet. Erdem Yasar is a news editor at Cloud7 News. Erdem started his career by writing video game reviews in 2007 for PC World magazine while he was studying computer engineering. In the following years, he focused on software development with various programming languages. After his graduation, he continued to work as an editor for several major tech-related websites and magazines. During the 2010s, Erdem Yasar shifted his focus to cloud computing, hosting, and data centers as they were becoming more popular topics in the tech industry. Erdem Yasar also worked with various industry-leading tech companies as a content creator by writing blog posts and other articles. Prior to his role at Cloud7 News, Erdem was the managing editor of T3 Magazine. Leave a Reply

7 biggest data breaches in the history of the internet

Written on the 5 April 2019 by David Simmons
The UpGuard Cyber Risk Team has discovered that two third-party developed Facebook app datasets have been found exposed online. One of these, originating from Mexican media company Cultura Colectiva, contains over 540 million records detailing comments, likes, reactions, account names, Facebook IDs, and more. A separate backup from a Facebook-integrated app called 'At the Pool' was also found to be vulnerable online. This dataset contained user information including likes, checkins, groups, interests, passwords, and ID data for 22,000 users of the 'At the Pool' app. UpGuard says in a blog post that these types of breaches demonstrate Facebook's lack of control over user data. "As Facebook faces scrutiny over its data stewardship practices, they have made efforts to reduce third party access. But as these exposures show, the data genie cannot be put back in the bottle," says UpGuard. "Data about Facebook users has been spread far beyond the bounds of what Facebook can control today. Combine that plenitude of personal data with storage technologies that are often misconfigured for public access, and the result is a long tail of data about Facebook users that continues to leak." Concerningly, it took Facebook nearly two months to secure the data from the Cultura Colectiva leak despute UpGuard alerting the social media giant to the leak. "These two situations speak to the inherent problem of mass information collection: the data doesn't naturally go away, and a derelict storage location may or may not be given the attention it requires," says UpGuard.

Faceboook data from over 540 million users found exposed online

Suite à la découverte d’une nouvelle fuite de données concernant les utilisateurs de Facebook concernant plus de 540 millions de dossiers laissés exposés sur des serveurs Internet publics. Parmi celles-ci figuraient :
 un ensemble de données, lié à l’entreprise de médias mexicaine Cultura Colectiva, contenant plus de 540 millions d’enregistrements, dont des commentaires, des likes, des réactions, des informations de compte, des ID Facebook et plus encore. un ensemble, lié à une ancienne application Facebook appelée At the Pool, était beaucoup plus petit, mais contenait des mots de passe en clair pour 22 000 utilisateurs. Voici le commentaire de Naaman Hart, Cloud Services Security Architect chez Digital Guardian :
« Les utilisateurs doivent être conscients qu’à partir du moment où ils fournissent leurs informations à une entreprise telle que Facebook, ces données sont désormais susceptibles d’être régulièrement vendues. C’est le prix à payer pour l’accès à un service gratuit. Bien que Facebook lui-même n’ait pas compromis ces données, c’est pourtant bien le réseau social qui a permis qu’elles soient librement exploitée par des entreprises dont les mesures de sécurité sont laxistes. En ce sens, ils n’ont pas aidé leurs clients à protéger leurs données, ils ont même plutôt fait le contraire. »
« A l’ère du RGPD, les entreprises doivent réaliser qu’à partir du moment où elles collectent des données, elles en sont responsables, qu’elles partagent ces dernières avec un écosystème de partenaires ou qu’elles les conservent pour leur propre usage. Il sera intéressant de voir si des litiges découleront de cette nouvelle affaire, mais les probabilités en ce sens sont plutôt fortes. Dans ce cas, le préjudice financier et les atteintes à la réputation de Facebook pourraient les inciter à s’assurer que les entreprises avec lesquelles ils font affaire soient tenues de respecter leurs propres normes de sécurité. Enfin, on peut toujours rêver... »

Nouvelle fuite Facebook, le Commentaire Digital Guardian

Giant trove of Facebook user data was in open AWS S3 bucket
In plain sight say cyber security researchers. Once again data collecting companies' careless use of cloud storage has come back to bite them, after security researches found gigabytes of personal information with no access controls on an Amazon Web Services S3 instance. Security vendor Upguard said it discovered two data sets on open AWS S3, with information collected from Facebook users by third party apps running on the social media network. The largest was collected by Mexican media company Cultura Colectiva. It is 146 gigabytes in size with over 540 million records. Upguard said the Cultura Colectiva MongoDB database contained Facebook users' comments, likes, reactions, account names and other details, and appears to have been collected between 2017 and 2018. Although Cultura Colectiva was notified of the open AWS S3 bucket twice in January, Upguard said no response has been received from the Mexican media company. AWS was contacted too by Upguard in February, and said it would look into the issue. However, the open Cultura Colectiva database was not secured until this week, after media contacted Facebook for comment on the data breach. Upguard also found a smaller data set in a separate AWS S3 instance which it says was a back up from the "At the Pool" app. Although smaller, that data set contained passwords for 22,000 Facebook users in clear text. This presents a risk to people who reuse their passwords across multiple accounts, Upguard said. Upguard says the latest Facebook-related data breaches are part of an ongoing problem with mass information collection and the careless, insecure handling thereof. "The data exposed in each of these sets would not exist without Facebook, yet these data sets are no longer under Facebook’s control. In each case, the Facebook platform facilitated the collection of data about individuals and its transfer to third parties, who became responsible for its security. The surface area for protecting the data of Facebook users is thus vast and heterogenous, and the responsibility for securing it lies with millions of app developers who have built on its platform," the security researchers said. Facebook said last month it resolved a glitch that exposed passwords of millions of users stored in readable format within its internal systems to its employees. Facebook and Amazon did not immediately respond to requests for comment. With Reuters.

Giant trove of Facebook user data was in open AWS S3 bucket

/ CBS News
Zuckerberg supports more internet regulation
More than 540 million records about Facebook users were publicly exposed on Amazon's cloud computing service, according to a cybersecurity research firm. A report out Wednesday by UpGuard  said two third-party Facebook app developers posted the records in plain sight, causing yet another major data breach for the world's biggest social network. According to UpGuard, a Mexico-based media company called Cultura Colectiva was responsible for the biggest leak. It exposed 146 gigabytes of Facebook user data, including account names, IDs and details about comments and reactions to posts. It's unclear how many individual users had data exposed. Separately, an app called At the Pool exposed databases that appeared to include data about user IDs, friends, photos and location check ins, as well as unprotected Facebook passwords for 22,000 users. The app —  which was meant to help people meet up for offline activities —  shut down in 2014. UpGuard said it alerted Cultura Colectiva and Amazon about the breaches from Cultura Colectiva in January, but no action was taken until Wednesday morning. After Bloomberg reached out to Facebook for a comment about that breach, an Amazon "storage bucket" with the data from Cultura Colectiva was secured. The data from At the Pool went offline before UpGuard reached out about it. Facebook is under federal criminal investigation for deals it struck with electronics manufacturers to access user data, and it has been hit a series of security breaches over the past year. The British analytics firm Cambridge Analytica, which worked with the Trump campaign in the 2016 election, got access to data from more than 87 million users ; and Facebook last September said that an attack on its networks exposed information from nearly 50 million users. Facebook said it has more than 2.3 billion active monthly users worldwide. Challenges for Facebook a year after Cambridge Analytica scandal
First published on April 3, 2019 / 8:38 PM
© 2019 CBS Interactive Inc. All Rights Reserved.

Millions of Facebook user records were exposed on Amazon cloud server

Unattributed VC

Cultura Collective is a medium for the dissemination of artistic, cultural and social activities.

Wells Fargo Success Story

Professional Services

Platform Overview

Cultura Colectiva

Compete with Cultura Colectiva?

Compete with Cultura Colectiva?

Discover the right solution for your team