Senator Mark Warner called it the worst telecom hack in US history, and it’s the strongest real-world argument to date that mandated lawful access backdoors become adversary access backdoors. 23andMe is the clearest demonstration that some data can’t be reset, revoked or reissued. Genetic and ancestry data is permanent and implicates biological relatives who never used the service. The targeting of specific ethnic groups moved the incident beyond financial fraud into the territory of persecution risk. The single most damaging breach of the US federal government exposed the most intimate documents the government holds on its own people.
Because users were authenticated, health-related browsing was linkable to identifiable patients and was shared with third parties for advertising. It’s the largest of the pixel-tracking HIPAA cases and it forced a sector-wide audit of web analytics on patient-facing properties. Aflac was the largest casualty of the coordinated 2025 campaign against US insurers, which also hit Erie Insurance, Philadelphia Insurance Companies and others in quick succession. The incident is instructive because Aflac detected and contained the intrusion within hours, which was operationally impressive, yet the attackers still exfiltrated data on more than 22 million people in that window. Speed of detection does not by itself limit blast radius when the compromised account has broad data access. The second AT&T breach is uniquely serious because call detail records are a map of everyone a person knows.
January 14
The company’s global operations were disrupted for several days, with a significant financial impact estimated at over $136 million per day. Names, birthdates, addresses, phone numbers, donation history, demographics, and other PII. The University of Pennsylvania was the victim of two breaches in the same month. The first involved breaking into to its email system and sending out “you’ve been hacked” communications. At least 500 consumers in California, as well as an unknown number of customers in Massachusetts, Montana, and Texas.
Sometimes, mistakes like weak passwords or falling for phishing scams can open the door for cybercriminals, turning simple errors into full-blown breaches. The questions they’re BestDates.com app pursuing reflect how deeply data breaches have become embedded in economic and corporate life. Economists are modeling how breaches propagate through supply chains and affect market concentration. Finance researchers are studying whether ESG scores or CEO characteristics predict breach vulnerability. Legal scholars are examining which breach types lead to class action litigation and how often victims receive compensation.
Petco Breach Exposes Sensitive Customer Data
- A database holding the personal information of over a billion Indians was leaked and sold online in 2018.
- As attackers become increasingly sophisticated, their methods become meticulously planned to unearth vulnerabilities and identify individuals who are susceptible to an attack.
- It is thought that more than two million babies born during this period have had their healthcare data exposed.
- That gap, roughly 2.3 times the global figure, is the practical reason US organizations can’t treat breach economics as an abstract risk.
- In 2018, Twitter urged its 330 million users to change and update their passwords after a bug exposed them.
Governments around the world found that Equifax had failed in its data handling duties because they didn’t update their software when alerted. They also failed other data handling issues that included poor general security and failure to alert regulatory bodies as soon as possible. The end result was over $575 million in fines, a massive drop off in stock prices due to investor mistrust, and a reputation that Equifax is still trying to repair to this day. While MySpace had been fined by the FTC in the past for data handling failures, their swift actions to protect customers allowed MySpace to avoid penalties for this privacy breach.
The intrusion began with a single Citrix account without multi-factor authentication. ShinyHunters listed 1.3 terabytes of Ticketmaster data for 500,000 dollars in May 2024, claiming records on 560 million customers. Live Nation confirmed in an 8-K that data had been taken from a third-party cloud database, later identified as Snowflake.
Unfortunately, that link became publicly available, meaning anyone could view the documents. Immediately inform the supervisory authority, notify affected individuals quickly and transparently, fix the cause, and prevent renewed risks. After the breach came to light, Dior immediately launched an internal investigation and tightened its security requirements for external partners.
The cause was a supply-chain attack involving the breach of a third-party e-commerce service provider used by Harrods. Names, email addresses, Quantas Frequent Flyer numbers, phone numbers, dates of birth, and home addresses. The organization should use tools for sensitive data discovery and remediation.
According to the Cost of a Data Breach 2026 report, it takes an average of 247 days to identify and contain an active breach across all industries. Deploying the right security solutions can help organizations detect and respond to these breaches faster. Russian spies gained access to the confidential information of various US government agencies, including the Treasury, Justice and State Departments, that use SolarWinds’ services. Hackers gained access to the data by planting traffic sniffers on the wireless networks of two stores. The sniffers allowed the hackers to capture information as it was transmitted from the store’s cash registers to back-end systems. For example, the average cost of a data breach in the United States is USD 11.5 million, about 4 times the cost of a breach in India (USD 2.79 million).
The city’s refusal to pay the ransom led the attackers to leak a significant amount of stolen data publicly. The compromised data varied by customer but primarily included names, email addresses, phone numbers, dates of birth, addresses, and Qantas Frequent Flyer details. Importantly, the airline stated that no credit card details, financial data, or passport information were stored on the breached platform and were therefore not compromised. Workday is an American on-demand, cloud-based software vendor specializing in financial management and human capital management systems.
Google, Allianz Life, Air France–KLM, and TransUnion were among the organizations hit, with many of the attacks traced back to the ShinyHunters hacking group. Instead of breaking into core systems, the attackers took advantage of third-party platforms like Salesforce and Drift, using social engineering to slip past defenses. The through line across four decades of incidents is that scale rarely comes from sophistication. That shifts the defensive priority from your own perimeter to the security posture of every vendor, contractor, and connected application you rely on. Continuous visibility into third-party exposure, not a once-a-year questionnaire, is what helps you prevent data breaches of the kind that fill this list.
Each entry preserves the reported record count and any dispute or estimate flag, along with the attack vector and aftermath that make it worth studying. Although all data breaches fall under the umbrella of a “cyberattack,” cyberattacks are not limited to data breaches. Some cyber attacks have different motivations – such as slowing a website or service down or causing some other sort of other disruption. As discussed in the introduction to this article, this is not the first time that T-Mobile has fallen victim to a high-profile cyber attack impacting millions of customers. The Healthcare provider is one of the biggest in the state, with more than 40 clinics dotted in and around Kentucky’s state capital, Louisville, TechCrunch reports. Although the data breach happened between May 7 and May 9, it only came to light this month when it was filed with Maine’s attorney general.
A report by Bloomberg said the information stolen included employee dates of birth, social security numbers, and home addresses. In 2013, Yahoo experienced the first of several data breaches by unauthorized third parties, breaches that continued into 2014. However, while Yahoo! worked with both security companies and law enforcement to address the beach, they failed to notify affected user accounts and governments around the world. This continued until 2016, when a user attempted to sell over 200 million Yahoo! accounts and the personal information from over 500 million other Yahoo! users.
The lasting significance is the phone numbers, which are durable identifiers that enable SIM swapping and messaging account takeover and, unlike a password, cannot be rotated. Rather than attacking 760 companies individually, the group tracked as ShinyHunters and UNC6395 compromised one integration vendor and inherited authorized OAuth access to every customer that had connected the Drift chatbot to Salesforce. A seller using the handle ChinaDan advertised 23 terabytes of data from the Shanghai National Police database on Breach Forums for 10 bitcoin, claiming it covered around 1 billion Chinese residents. Reporters at multiple outlets verified entries from the 750,000 record sample by calling individuals listed in it, and the presence of police case notes made the exposure unusually sensitive. Beijing censored discussion of the incident domestically and never officially acknowledged it, so the full scope has never been confirmed, but if accurate it is the largest known breach of a government-held citizen database. The list runs from the largest exposed datasets ever documented down to smaller but landmark incidents.
Equifax spent an estimated $337 million on improving its technology and data security, legal and computer forensic fees and other direct costs alone. Experts advise consumers to consider freezing credit with the three major bureaus (Equifax, Experian, and TransUnion) and using identity theft protection services as potential precautions. Marriott learned during the investigation that there had been unauthorized access to the Starwood network since 2014. “Marriott recently discovered that an unauthorized party had copied and encrypted information and took steps towards removing it. On November 19, 2018, Marriott was able to decrypt the information and determined that the contents were from the Starwood guest reservation database,” the statement added. Over an eight-month period, a developer working for an affiliate marketer scraped customer data, including usernames and mobile numbers, from the Alibaba Chinese shopping website, Taobao, using crawler software that he created.
However, MTN Ghana has confirmed that approximately 5,700 of their customers may have been impacted. The breach was caused by the exploitation of vulnerabilities in Cleo’s file transfer software, including flaws that allowed unauthorized file uploads/downloads and command execution. The leaked data included applicants’ full names, email addresses, and phone numbers. The breach affected the personal information of up to 6 million Qantas customers, with Qantas later confirming a precise figure of 5.7 million unique customer records. The company did not specify the number of individuals or businesses impacted. The breach affected approximately 144,189 individuals, primarily employees and job candidates who had worked with the Lansing franchise.
The breach resulted from a former business partner using outdated software and vulnerabilities in a third-party vendor’s cloud system. Hundreds of thousands of customers were likely affected, though exact numbers remain unconfirmed. The hacking incident compromised the data of approximately 1.9 million patients. The data of all 6.5 million members of the Co-op’s loyalty program was compromised in the incident.
This scenario constitutes a privacy breach, as it must be assumed that someone was able to access the records. Institutions may be notified of a breach that affects information held by a third party as part of a contract, agreement or arrangement with the institution. If Public Services and Procurement Canada (PSPC) manages the contract or agreement that is subject to the breach the OPI, in coordination with privacy officials, must alert PSPC’s Special Investigations and Internal Disclosure Directorate.
Corporate records and potentially customer data, including accounting documents and legal agreements. Going back to 2018, a massive breach exploited a vulnerability in Facebook’s “View As” feature, exposing nearly 30 million accounts globally. Regulators hit Meta with a hefty €251 million ($263 million) fine for failing to safeguard user data under GDPR standards. This could be intentional, like an employee selling company data, or through negligence, like using weak passwords that let criminals break in.