Security Alerts

The 20 Biggest Data Breaches in History

Ezznology عز التقنية • Jul 02, 2024 2 views • ⏱ 1 min read • 💬 0 comments

4. First American Financial Corporation 2019
5. Aadhaar 2018
6. MySpace 2013
7. LinkedIn 2021
8. Friend Finder Networks 2016
9. JPMorgan Chase 2014
10. Home Depot 2014
11. Target 2013
12. Heartland Payment Systems 2008 – 2009
13. Dubsmash 2018
14From 2014 to 2018, Marriott International suffered a massive data breach related to the Starwood Preferred Guest reservation database. The number of records affected in this breach reached approximately 383 million guest records. Highly sensitive personal information was exposed, such as names, addresses, phone numbers, email addresses, passport numbers, Starwood Preferred Guest (SPG) account information, dates of birth, gender, reservation details, and payment card details.
15. Adobe 2013
16. Capital One 2019
17. Mother of All Breaches (MOAB) 2024
18. Advanced Info Service 2020

The 20 Biggest Data Breaches in History

A data breach occurs when an unauthorized person gains access to specific information. This information covers a wide range of data, from personal information to financial records held by organizations. These breaches can cause problems for both businesses and individuals alike. In this article, we will explore some of the biggest data breaches in history and discuss their impact on cybersecurity practices and public awareness.

1.Yahoo (2013-2016):

Between 2013 and 2016, Yahoo suffered one of the largest data breaches in history. More than 3 billion user accounts were compromised, affecting users' personal data. A group of Russian hackers infiltrated Yahoo's database using backdoors, stolen backups, and cookies to gain access. They were able to access usernames, email addresses, phone numbers, dates of birth, encrypted passwords, and even security question answers.

Initially, Yahoo announced that around one billion accounts had been affected, but after Verizon's acquisition of Yahoo in 2017, it became clear that the true number of affected accounts reached 3 billion. Yahoo faced sharp criticism for its slow response and failure to disclose the 2014 breaches to users, which led to a $35 million fine and 41 class-action lawsuits. The incident also affected the acquisition deal by Verizon, causing the sale price to drop by $350 million, bringing the total deal value to $4.48 billion.

3.Facebook 2019

In 2019, an unprotected server was discovered containing a database with information on approximately 533 million Facebook users worldwide. This data included phone numbers, Facebook IDs, email addresses, and other user details. The data was published freely on the internet on a hacking forum in April 2021.

Although the server owner was not identified, the database was quickly shut down after discovery. Facebook reported that the data was likely collected before the feature allowing others to be found using phone numbers was disabled.

This incident caused widespread concern and criticism regarding Facebook's data protection practices. The company decided not to notify the more than 530 million affected users whose data had been breached before August 2019.

4. First American Financial Corporation 2019

In 2019, First American Financial Corporation, a leading real estate insurance company, suffered a major data leak due to weak security measures and a flawed website design.

This incident was classified as a data leak rather than a traditional data breach, as the information was not accessed through unauthorized means, but due to a design flaw known as Insecure Direct Object Reference (IDOR), which allowed people to access private information without authorization or authentication. Because of this flaw, anyone with a link to a document could view it, and users could easily modify the index number in the URL to access other customers' data.

The records, which dated back to 2003, included sensitive documents such as bank account details, bank statements, mortgage payment documents, wire transfer receipts with Social Security numbers, and even driver's licenses.

This breach raised concerns about the security of online real estate transactions and led to regulatory investigations. The company was fined approximately one million dollars by the New York Department of Financial Services for violating cybersecurity laws and ignoring red flags. The breach also prompted lawsuits from affected individuals on charges of negligence and failure to protect sensitive customer data.

5. Aadhaar 2018

In January 2018, the Aadhaar system — the world's largest biometric identity system — was revealed to have been breached by malicious actors. The breach exposed personal and biometric information of more than 1.1 billion Indian citizens. The stolen data included usernames, addresses, photos, phone numbers, emails, as well as sensitive data such as fingerprints and iris scans.

The breach was carried out through the website of Indane, a state-owned company. The site's API, which lacked proper access controls, was connected to the Aadhaar database. Hackers exploited this security vulnerability and sold access to the data for just $7 through a WhatsApp group. Despite warnings from cybersecurity researchers and technology groups, Indian authorities did not secure the exposed access point until March 2018.

This incident sparked fierce debates about data protection laws and prompted users to demand stricter regulations and better security measures to protect sensitive biometric information.

6. MySpace 2013

In June 2013, MySpace was breached and more than 360 million user accounts were accessed. Although the site had transitioned into a music promotion platform, it still attracted millions of visitors. The stolen data, which included usernames, email addresses, and dates of birth, was published on the dark web in 2016.

Before 2013,, MySpace used a Secure Hash Algorithm (SHA-1) to encrypt passwords. This system is known to be insecure because it is easy to crack, as passwords are converted into a fixed string of characters. In contrast, modern password authentication protocols use a salted hash algorithm that adds a random string of characters to enhance security.

Around 360 million accounts were affected by the breach, causing significant concern among users. The stolen data was leaked on LeakedSource.com and sold on the dark web for six Bitcoin (approximately $3,000 at the time).

However, MySpace confirmed that all stolen data dated back to before 2013, and the company has updated its security procedures since then. All stolen passwords were invalidated and affected users were notified of the breach, causing them to reset their passwords upon logging back into the site.

7. LinkedIn 2021

In April 2021, the LinkedIn platform suffered a massive data breach affecting more than 700 million users, representing over 93% of the user base at the time. The data was extracted by exploiting the site's API, and although some of the stolen data was publicly available, this act violated LinkedIn's terms of service.

The exposed data includes full names, phone numbers, email addresses, usernames, geolocation records, gender, and linked social media account details. This information was published in June 2021 on a dark web forum.

The hacker known as "God User" initially offered a dataset containing 500 million users, then later announced having up to 700 million records for sale. Smaller hackers attempted to sell LinkedIn data on public forums, with one user offering the information for $7,000 USD in Bitcoin.

Although LinkedIn confirmed that no sensitive personal data was exposed, the data leak poses a significant threat to security and privacy. The UK's National Cyber Security Centre advised LinkedIn users that their detailed data could expose them to sophisticated social engineering attacks.

8. Friend Finder Networks 2016

In November 2016, FriendFinder Networks, a well-known adult entertainment company, suffered a massive data breach. Six of the company's main databases were affected, including AdultFriendFinder and Penthouse.

This breach, which included data spanning more than 20 years, resulted in the leaking of sensitive information from approximately 412 million accounts. 15 million accounts had been deleted from the databases but were not fully removed. The stolen data included usernames, email addresses (including government and military addresses), user activity, transactions, membership details, IP addresses, and browser information.

FriendFinder Networks responded to this breach by strengthening security measures. The company also notified affected users of the need to change their passwords and review their online security practices.

This breach follows a similar incident in May 2015, in which another 3.5 million accounts were compromised. Despite these breaches, AdultFriendFinder continued to attract more than 50 million monthly visitors worldwide.

9. JPMorgan Chase 2014

In June 2014, JPMorgan Chase, one of the largest financial institutions in the United States, suffered a major data breach. Approximately 76 million households and 7 million small businesses were affected as a result of this breach.

Initially, the breach was thought to have affected only one million accounts, but it later turned out to be far deeper and lasted for two months. The attackers were able to access sensitive customer information such as names, addresses, phone numbers, and email addresses. Fortunately, the attackers were unable to access any financial information.

It turned out that the hackers infiltrated JPMorgan's servers by stealing the identity of one of the bank's employees, leading to the theft of a large amount of sensitive data. Authorities linked the breach to Russian entities, and the hackers' goal was to carry out a criminal operation involving pump-and-dump stock schemes, breaching other banks, running online casinos, money laundering, and illegal Bitcoin exchange.

Following the breach, JPMorgan Chase executives committed to an annual investment of $250 million to strengthen the company's data security. The incident also highlighted the importance of strengthening cybersecurity measures in financial institutions to protect customer data. In November 2015, three individuals involved in the breach were charged, revealing the criminal network behind the attack.

10. Home Depot 2014

In 2014, Home Depot, a well-known home improvement retail chain, suffered a major data breach. The company's self-checkout points of sale were infected with malware that allowed attackers to access the point-of-sale systems and steal approximately 56 million credit and debit card numbers and 53 million email addresses. The malware persisted in the systems for five months before being discovered, exposing millions of customers in the United States and Canada to the risk of fraud.

Investigations revealed that the attackers may have used a third-party vendor to gain access to Home Depot's servers. Once inside, they installed malware on the point-of-sale systems, enabling them to steal and upload payment data to a separate server. This breach exposed weaknesses in retail payment systems and the ability of malware to steal large amounts of data through point-of-sale terminals.

Following the incident, the company faced numerous lawsuits and regulatory investigations. Home Depot agreed to pay at least $19.5 million to affected customers and pledged to improve data security over two years. The company incurred losses estimated at around $180 million by 2020, including settlement costs with credit card companies and banks, as well as customer compensation.

11. Target 2013

In 2013, Target, a major U.S. retail chain, suffered a major data breach during the holiday shopping season. Attackers exploited vulnerabilities in Target's cybersecurity network, primarily through a third-party vendor portal, to install malware on the company's point-of-sale systems. This breach allowed the hackers to steal more than 41 million credit and debit card numbers, along with customer names, expiration dates, and CVV codes. Records of approximately 70 million customers were also breached to steal personal information.

The breach had serious consequences for Target, including financial losses, legal repercussions, and a negative impact on its reputation. In 2015, Target announced it would pay $10 million to customers affected by the breach. The company's total losses amounted to approximately $202 million ($292 million before insurance), covering settlements, lawsuits, and payments to banks and credit card companies.

In response to the breach, Target updated its cybersecurity procedures and information security policies. It began closely monitoring system activity, improving firewalls, whitelisting point-of-sale systems, restricting access for employees and third parties, and segmenting the network to prevent the spread of malware.

12. Heartland Payment Systems 2008 – 2009

In May 2008, Heartland Payment Systems, a payment processing company, suffered a major data breach. The company processed approximately 100 million credit and debit card transactions monthly for approximately 175,000 merchants. The attackers breached Heartland's payment processing system through an SQL injection attack that began in 2007. This breach allowed them to modify web code and access customer login credentials. As a result, more than 130 million payment card details were compromised, making this incident one of the largest data breaches at the time.

Heartland's illegal activity was not discovered until October 2008, when Visa and Mastercard reported suspicious transactions. Investigations revealed that the attackers had infiltrated Heartland's systems undetected for several months, creating counterfeit credit cards using real magnetic stripes. The breach was disclosed in January 2009.

As a result of this breach, Heartland paid more than $110 million to credit card companies to settle breach-related claims. The company suffered total losses exceeding $200 million, including compensation to affected financial institutions and cardholders.

This breach led to comprehensive regulatory review and numerous lawsuits from affected parties. Within a few months of the incident, Heartland's stock prices fell significantly. In 2015, Global Payments, the largest payment processing company, merged with Heartland for $4.3 billion.

13. Dubsmash 2018

In December 2018, Dubsmash, a popular video-sharing application, suffered a major data breach. Hackers managed to breach the application's database and steal 162 million user records, including usernames, email addresses, encrypted passwords, geographic locations, and country information. This breach is considered part of a larger cyberattack that encompassed more than 617 million accounts across 16 different websites.

Subsequently, the stolen data was offered for sale on a dark web marketplace in December 2019. Dubsmash disclosed the breach and advised users to change their passwords, but did not reveal the specific details of the attack or the exact number of affected users.

This incident increased awareness of the data breach problem affecting various companies, such as Under Armour/MyFitnessPal, MyHeritage, Whitepages, Armor Games, and Coffee Meets Bagel. These breaches confirmed the collective impact of such events and indicated the need for stronger security measures to protect user data across digital platforms.

14From 2014 to 2018, Marriott International suffered a massive data breach related to the Starwood Preferred Guest reservation database. The number of records affected in this breach reached approximately 383 million guest records. Highly sensitive personal information was exposed, such as names, addresses, phone numbers, email addresses, passport numbers, Starwood Preferred Guest (SPG) account information, dates of birth, gender, reservation details, and payment card details.

In response to the breach, Marriott hired security experts and conducted an extensive investigation. The investigation findings revealed the company's failure to update Starwood's legacy reservation system after its acquisition in 2016. The legacy system turned out to be the main reason the company was exposed to malware and data breaches.

Marriott was fined £18.4 million by the UK's Information Commissioner's Office in 2020 for failing to secure customers' personal data. Additionally, the attack was linked, according to a New York Times report, to a Chinese intelligence group seeking to collect data on American citizens.

15. Adobe 2013

In October 2013, Adobe suffered a major data breach, resulting in the compromise of approximately 153 million user records. Hackers gained unauthorized access to sensitive details, such as Adobe user IDs, passwords, full names, and credit and debit card information. Product source code for applications such as Acrobat and ColdFusion was also stolen. Initially, the company believed the breach had affected about 3 million users, but it later became clear that the number was much larger.

Following the breach, Adobe was criticized for using a single password encryption key for all affected users, which exposed vulnerabilities in its data protection strategies. Its transition from selling desktop licenses to a cloud-based Software as a Service (SaaS) model made the company's infrastructure vulnerable, which contributed to this breach. In 2016, Adobe reached a settlement with 15 states for approximately one million dollars in a lawsuit addressing the breach of customer data and unfair business practices.

This breach was an important lesson and highlighted the need for all cloud services to focus on robust cybersecurity to protect user information from advanced cyber threats.

16. Capital One 2019

In July 2019, Capital One suffered a major data breach carried out by Paige Thompson, a former Amazon Web Services (AWS) employee. By exploiting an improperly configured firewall in Capital One's cloud infrastructure, Thompson was able to access and extract sensitive personal information from more than 100 million customer accounts and credit card applications dating back to 2005. The compromised data included names, physical addresses, credit scores, account balances, Social Security numbers, and Canadian Social Insurance numbers.

Capital One's response was swift, as it strengthened its security procedures and offered credit monitoring and identity theft protection services to affected individuals. Despite the breach, the company confirmed that less than 1% of Social Security numbers were compromised, and no credit card account numbers or login credentials were accessed.

Thompson's ability to exploit a firewall misconfiguration highlighted the vulnerabilities in Capital One's cybersecurity practices. The company faced regulatory scrutiny and legal proceedings, and in 2021 was forced to settle a class-action lawsuit for $190 million. This incident led to increased focus on strengthening security protocols in financial institutions.

17. Mother of All Breaches (MOAB) 2024

In January 2024, a massive personal data leak was discovered, dubbed the "Mother of All Breaches." This leak is considered the largest data breach incident in history to date, with approximately 26 billion user data records affected from 3,876 different websites. A total of 12 terabytes of user data were compiled in this incident.

The leaked data includes sensitive information from several prominent platforms such as Tencent QQ, Weibo, MySpace, Twitter, LinkedIn, Adobe, and others. This collection of leaked data consists of a mixture of old, duplicated, and potentially new data from previous breaches and other leaks.

Although there is no direct evidence of misuse of the leaked data, the leaking of such sensitive personal data — including usernames, passwords, email addresses, IP addresses, and payment records — poses a significant risk to identity confidentiality and can lead to fraudulent attacks and targeted cyberattacks.

Organizations and individuals affected by this massive leak were advised to strengthen their security measures, such as regularly updating passwords, monitoring suspicious activities, and using multi-factor authentication.

The "Mother of All Breaches" incident underscores the urgent need to strengthen cybersecurity measures to combat the growing threat of cybercrime. As the investigation continues, it is essential for companies to ensure robust security protocols to protect their data and prevent future massive data breach incidents. Although the responsible party has not yet been identified, the scale and scope of this leak emphasize the necessity of adopting stronger cybersecurity protocols.

18. Advanced Info Service 2020

In May 2020, Advanced Info Service (AIS), Thailand's largest mobile telecommunications company, suffered a major security vulnerability. It was discovered that a database belonging to AIS was not properly secured, resulting in the leakage of approximately 8.3 billion data records. Although this data did not include personal details such as names or phone numbers, it did contain information revealing which websites users had visited and which applications they had used.

In response to this incident, AIS took measures to address the issue quickly. The exposed database was secured and comprehensive investigations were conducted to understand the scope of the impact and identify security vulnerabilities. The company also cooperated with relevant authorities to strengthen security procedures and improve data protection policies to ensure that such incidents do not recur in the future.

This incident reflects the urgent need to strengthen security measures in the telecommunications sector and protect user data. Data leaks can expose individuals to risks and threats such as fraud and cybercrime. Therefore, companies must take the necessary security measures to protect users' personal data and raise awareness of the importance of cybersecurity among employees and customers.

19. CAM4 2020

In March 2020, CAM4, an adult live-streaming platform, suffered the largest data breach in its history when researchers discovered an unsecured database. As a result of a misconfigured production server, an enormous amount of data — up to 7 terabytes — was exposed, totaling approximately 10.88 billion records. Sensitive information was leaked in this data, including full names, email addresses, payment records, IP addresses, sexual preferences, chat transcripts, and encrypted passwords.

Following the incident, CAM4 indicated that there was no evidence of malicious exploitation of the data before the database was secured. However, this breach exposed the information of millions of users worldwide, putting them at risk of privacy violations and future phishing attempts.

This incident highlights the urgent need to strengthen security measures and protect personal data on digital platforms. Companies responsible for collecting and storing data must be aware of cyber threats and implement strict security measures to protect users' personal information. Additionally, users should follow strong security practices such as using strong passwords, updating their software, and being cautious about sharing personal information online.

And with that, dear friend, we have successfully completed the mission ✌

Don't forget your brothers and sisters in Palestine in your prayers

With greetings from the #Ezznology team

Find what interests you on 👈#our store

You can become a member of our family by joining the Telegram group from 👈here

or the Facebook group from 👈here

To subscribe to our newsletter on Google News, click here✌👇

or scan the code

Ezznology عز التقنية

Writer at Ezznology عز التقنية — sharing the best tech articles and tutorials.

—

★ ★ ★ ★ ★

0 ratings

Rate this article

💬 Comments 0

💬

No comments yet — be the first to comment!

✏️ Leave a Comment

7 Fatal Mistakes When Connecting to Public Wi-Fi

The 20 Biggest Data Breaches in History

The 20 Biggest Data Breaches in History