A Big List Of Popular Data Breaches and What Can Your CloudOps Team Learn From Them
Recently a website called “Have I Been Pwned” became viral. People started logging into their accounts using this only to discover all the different websites stealing their data for ever so long. It was touted to be a website that allows Internet users to check whether data breaches have compromised their data. Troy Hunt of HaveIBeenPwned, discovered a massive MySpace breach. The passwords were stored as SHA-1 hashes of the first ten characters of the password converted to lowercase. These were up on sale on the dark web!
A million logins later, it was discovered that the free service itself is not the safest out there! Security specialists warned against using it with accounts that are private and official. Here you go, a perfect business model where people’s sentiments against cyber breaches are used to garner their attention and traffic into a service that primarily takes in massive account details.
Here are some major Cyber Data Breaches that this generation saw and what your CloudOps can learn from them!
Starting with the biggest data breaches of the decade!
Yahoo announced in September 2016 that in 2014 it had been the victim of what would be the biggest data breach in history. The attackers, which the company believed we “state-sponsored actors,” compromised the real names, email addresses, dates of birth, along with telephone numbers of 500 million users. Yahoo claimed that most of the compromised passwords were hashed.
Yahoo timed its announcement of the massive breach poorly, as it was in the process of being acquired by Verizon, which eventually paid $4.48 billion for Yahoo’s core internet business. The breaches knocked off around $350 million of the value of the company. Later in December 2016, Yahoo disclosed another breach from 2013 by a different attacker that compromised the names, dates of birth, email addresses and passwords, and security questions and answers of 1 billion user accounts. Yahoo revised that the estimate was around 3 million accounts in October 2017!
Moving forward to the professional social networking giant, LinkedIn.
LinkedIn became a lucrative project for attackers looking to conduct social engineering attacks. It has also fallen prey to leaking user data in the past. The company announced that 6.5 million unassociated passwords (unsalted SHA-1 hashes) were stolen by attackers and subsequently shared onto a Russian hacker forum in 2012.
However, it wasn’t until 2016 that the full magnitude of the incident was unveiled. The hacker that had earlier stolen and sold MySpace’s data was found to be offering the email addresses and passwords of around 160 million LinkedIn users for an estimated five bitcoins, which was around $2,000 at the time. LinkedIn later admitted and made a statement saying that it had been made aware of the breach and claimed it had reset the affected accounts’ passwords.
Chinese Job Seekers MongoDB Data Breach is next on the list.
In January 2019, Bob Diachenko, a cybersecurity expert at a cybersecurity company, found an 854 gigabyte MongoDB database that contained a whopping 202 Million records of job candidates from China. The data contained the candidate’s skills and work experience and PII, such as phone numbers, email addresses, marriage status, political leanings, height, weight, driver’s license information, salary expectations, and other highly personal data.
In May 2019, Diachenko once again revealed that he had discovered a MongoDB database leaking 275 Million records of Indian citizens that contained PII highly. The database was left unprotected for more than two weeks. Diachenko said the publicly accessible MongoDB database hosted on Amazon Web Services included personal information such as name, gender, date of birth, email, phone numbers, education details, professional information, and current salaries.
The Register reported that some 617 million online account details stolen from over 16 hacked websites were selling like hotcakes on the dark web in February 2018.
The following account databases were up for sale on Dream Market:
- Dubsmash (162 million)
- MyFitnessPal (151 million)
- MyHeritage (92 million)
- ShareThis (41 million)
- HauteLook (28 million)
- Animoto (25 million)
- EyeEm (22 million)
- 8fit (20 million)
- Whitepages (18 million)
- Fotolog (16 million)
- 500px (15 million)
- Armor Games (11 million)
- BookMate (8 million)
- CoffeeMeetsBagel (6 million)
- Artsy (1 million)
- DataCamp (700,000)[ Source]
Credit Card Details Hacked at Adobe
During the early onset of October 2013, security blogger Brian Krebs from Adobe initially reported that hackers had swept away nearly 3 million encrypted customer credit card records, plus login data for an unspecified number of user accounts. Later that month, Adobe rectified that estimate to include IDs and encrypted passwords for many 38 million active users.
Krebs reported that a file posted just days earlier appears to include around150 a million usernames and hashed password pairs stolen from Adobe. Rigorous audits and research showed that the hack had also left customer names, IDs, passwords, and debit and credit card information are vulnerable.
An agreement was signed in August 2015 that called for Adobe to pay a whopping $1.1 million in legal fees and an undisclosed amount to users to settle claims of violating the Customer Records Act along with unfair business practices. The amount paid to customers was reported at $1 million, as disclosed in November 2016.
Also added to this list was Zynga.
Zynga is the Farmville pioneer, which later Facebook acquired. It was exposed to a cyber breach that left 218 million user accounts vulnerable in September 2019. The Pakistani hacker group, Gnosticplayers carried out the breach. Breaches can occur in every field of business. Maintaining adequate security policies and discipline is paramount.
How Can Cloudanix Help in data breaches?
Cloudanix helps you implement the best practices of security for your cloud which will help minimize data breaches. We offer a variety of rules and recipes that follow the best practices laid down by NIST, CIS, GDPR, HIPAA and more! We offer this support for major cloud providers like AWS, GCP and Microsoft Azure. You can sign up for your free trial today!