The leaked records include email addresses, usernames, hashed passwords, users country, whether they signed up for the newsletter and other sensitive information. This incident was the impetus to Joe Biden's Cybersecurity Executive Order that now enforces all organizations to strengthen their supply chain security efforts. The searchable and well-organized database was leaked to a popular hacking forum, giving hackers access to account credentials, including approximately200 million Gmail addresses and 450 million Yahoo email addresses. The data consisted of 1.1 terabytes of voter Personal Identifiable Information (PII) including names, addresses and birthdates. Because passwords are usually recycled, this gave them instant access to a swathe of active Zoom accounts. The leaked user records include usernames, emails, IP addresses, hashed passwords, Facebook, Twitter and Google IDs, bets and data on players who were banned from the platform. 1 Min Read. April 12, 2021: A third-party software vulnerability is responsible for exposing 21 million customer records belonging to ParkMobile, a contactless payment parking app. January 26, 2021: VIPGames.com, a free gaming platform, exposed over 23 million records for more than 66,000 desktop and mobile users due to a cloud misconfiguration. The UK's Information Commissioner's Office (ICO) issued more than 42 million ($59m) worth of fines in 2020 to companies that breached data protection and privacy regulations. The stolen information includes names, travelers service card numbers and status level. Between 2013 and 2016, anyone who gained access to this breached information could have taken over any Myspace account. The data was dumped in two waves, initially exposing 500 million users, and then a second dump where the hacker "God User" boasted that they were selling a database of 700 million LinkedIn. Impact:Exposure of the credit card information of 56 million customers. But, as we entered the 2010s, things started to change. This makes Facebook one of the recently hacked companies 2021, and therefore, one of the largest companies to be hacked in 2021. Learn about the dangers of typosquatting and what your business can do to protect itself from this malicious threat. Impact:Personal information of 57 million Uber users and 600,000 drivers exposed. Sociallarks, a rapidly growing Chinese social media agency suffered a monumental data leak in 2021 through its unsecured ElasticSearch database. Learn about how organizations like yours are keeping themselves and their customers safe. 8.3 million database records from popular stock photo and vector image seller 123RF were copied and posted for sales on a hacker forum. Enhancing Data Security - U.S. Senate Committee Hearing - Oct. 6, 2021 The ITRC will testify before the U.S. Senate Committee on Commerce, Science & Transportation today to present the findings from our Q3 Data Breach Analysis. The attack also exposed customer information including names, addresses, email addresses, account numbers, social security numbers (SSNs), account personal identification numbers (PIN), account security questions and answers, date of birth, plan information and the number of lines subscribed to their accounts. The data that is potentially at risk includes customer contact information like email addresses and physical addresses, as well as login information like usernames and passwords. A hacker group breached the security systems of the Commission on Elections (COMELEC) for the Republic of the Philippines, compromising 60 gigabytes of sensitive voter information. Not all phishing emails are written with terrible grammar and poor attention to detail. The company determined cybercriminals infiltrated its systems and gained access to certain files, including employee names and Social Security numbers. Breaches appear in descending order, with the most recent appearing at the bottom of the page. A new IRS ruling recognizes employer paid ID theft protection as a non-taxable, nonreportable benefit. The breached database was discovered by the UpGuard Cyber Research team. Data breaches in the health sector are amp lified during the worst pandemic of the last century. Its. By clicking Sign up, you agree to receive marketing emails from Insider Wayfair had its first decline in annual revenue in 2021, after eight years of increases. At the time, this was a smart way of doing business. One, originating from the Mexico-based media companyCultura Colectiva, weighs in at 146 gigabytes and contains over 533 million records detailing comments, likes, reactions, account names, FB IDs and more. The specific security vulnerabilities and attack methods that facilitated the breach have not been disclosed, but its speculated that access was achieved via a database breach. The optics aren't good. Left unanswered is why LinkedIn did not further investigate the original breach, or inform more than 100 million affected users, in the intervening four years. Monitor your business for data breaches and protect your customers' trust. Twitchs internal red teaming tools, used by internal security teams for cyberattack training exercises. More than 150 million people's information was likely compromised. Onced breached, the hacker had access to over 320 million records from notifications being pushed out to Mailfire clients. Recipients of compromised Zoom accounts were able to log into live streaming meetings. Exposed information included names, mailing addresses, phone numbers, email addresses, passport numbers, dates of birth, gender, and other Starwood account information. The disclosed information included customer names, phone numbers, physical and email addresses, and the last four digits of their payment card, as well as the source code for the companys app. However, while the AWS bucket remained misconfigured, cybercriminals may have clandestinely exfiltrated the exposed data. While desperately scouring the client email lists stored in Mailchimps internal tools, the cybercriminals finally found what they were looking for - an email list of customers of the hardware cryptocurrency wallet, Trezor. The data leaks impacted American Airlines, Microsoft, J.B. Hunt and governments of Indiana, Maryland and New York City. Slickwraps, a manufacturer of vinyl skins for phones and tablets, suffered a breach impacting 370,000 of its customers.. Learn why cybersecurity is important. March 23, 2021: A phishing attack targeting the California State Controllers Office (SCO) Unclaimed Property Division led to an employee clicking on a malicious link, logging into a fake website and granting a hacker access to their email account. Darden Restaurants announced in August that it had been notified by government officials that it was the victim of a cyberattack. Hacking group identified as Impact Team compromised 35 million user records from the cheating website Ashley Madison. The database included names, display names, dates of birth, weight, height, genders and geolocations, the majority of which were from Fitbit devices and Apple Healthkit. According to the 2021 Year End Report: Data Breach QuickView, by Risk Based Security and Flashpoint, additional incidents continue to surface.It is typical for the number of breaches disclosed for a given year to subsequently increase by 5% to 10% as the data matures. Guy Fieri's chicken chain was affected by the same breach. January 11, 2021: A Chinese social media management company, Socialarks, suffered a data leak through an unsecured database that exposed account details and Personally Identifiable Information (PII) of at least 214 million social media users from Facebook and Instagram and LinkedIn. 5,000 brands of furniture, lighting, cookware, and more. Learn more about the Medicare data breach >. October 13, 2021: Cybersecurity researchers discovered an unsecured database that contained over82 million records belonging to the supermarket Whole Foods Market and Skaggs public safety and uniform company that sells uniforms for Police, Fire and Medical customers all over the United States, and others. In February 2019, email address validation service verifications.io exposed 763 million unique email addresses in a MongoDB instance that was left publicly facing with no password. Exclusive UK Jeweller, Gaff, suffered a data breach that compromised many of its famous clients. as well as other partner offers and accept our, Rafael Henrique/SOPA Images/LightRocket via Getty Images. Click here to request your free instant security score. After being ignored, the hacker echoed his concerts in a medium post. Sociallarks server wasnt password-protected, wasnt encrypted, and it was a publicly exposed asset. The type of information exposed included the photographs, thumbprints, retina scans and other identifying details of nearly every Indian citizen. Wayfairs average order value is one of the few metrics to increase from 2020 to 2021, rising 20% to $269. The attack wasnt discovered until December 2020. Apparently, hackers can change your email on your account which allows them to change the password to your account and give them full access. Wayfair, like most online retailers, saw a huge boom in revenues during the pandemic. Details about these discoveries can be found in our Aggregate IQ breach series (part 1, part 2, part 3and part 4). As youll see, even prestigious companies like Facebook, LinkedIn, and Twitter are vulnerable to the rising trend of data breaches. MyHeritage earned praise for promptly investigating and disclosing details of the breach to the public. In July 2018, Apollo left a database containing billions of data points publicly exposed. The breach contained 112 million unique email addresses and PII such as names, birthdates and passwords stored as MD5 hashes. MGM Grand assures that no financial or password data was exposed in the breach. After stealing Gaff's sensitive data and encrypting their internal systems, Conti started publishing some of the stolen records on the dark web, promising to only stop of their ransom of up to ten millions of pounds is paid. The stolen data includes email addresses, phone numbers, license plate numbers, hashed passwords and mailing addresses. Only the last four digits of a customer's credit-card number were on the page, however. On August 14, grocery chain Hy-Vee announced that it has launched an investigation to look into unauthorized transactions made at some of its fuel pumps, drive-thru coffee shops, and restaurants. Control third-party vendor risk and improve your cyber security posture. These data breaches are a real danger for both companies and customers, as they can damage the trust shoppers have in brands. There was a whirlwind of scams and fraud activity in 2020. January 22, 2021: Customer data was stolen from the mens clothing retailer, Bonobos, was found for free in a hacker forum after a cybercriminal downloaded the companys backup cloud data. We have collected data and statistics on Wayfair. was discovered by the security company Safety Detectives. May 25, 2021: Audio maker, Bose Corporation, disclosed a data breach following a ransomware attack. May 14, 2021: A cyberattack targeting the law offices of Bailey & Galyen exposed the personal information of an undisclosed number of clients and employees. The leaked details of more than 2.28 million users registered included names, email addresses, location details, dating preferences, marital status, birth dates, IP addresses, Bcrypt-hashed account passwords, Facebook user IDs and Facebook authentication tokens. The PII included clients names, dates of birth, drivers license or personal identification card numbers, Social Security Numbers, payment account numbers, payment card information, biometric data including but not limited to medical information and history, medical diagnosis and treatment information, health insurance information and other personal information. To prevent the repetition of mistakes that result in data theft, weve compiled a list of the 67 biggest data breaches in history, which includes the most recent data breaches in February 2022. The database was not password protected and allowed access to information including names, emails, phone numbers and dates contacted. In one of the biggest data breaches of all time in the education industry, the Los Angeles Unified School District (LAUSD) was attacked by Vice Society, a Russian criminal hacking group. The list of victims continues to grow. April 10, 2021:A database containing 1.3 million scraped Clubhouse userrecords were leaked for free on a popular hacker forum. Amazon began investigating the breach on the day it was disclosed to them with the third-party company involved shutting down the database on 8 February. Se ha llegado a un Acuerdo de Conciliacin en una demanda . The security vulnerability that made the breach possible was a server configuration change permitting unauthorized access by third parties. However, this initial breach was just the preliminary stage of the entire cyberattack plan. On February 21, Activision acknowledged that they suffered a data breach in December 2022, after a hacker tricked an employee via an SMS phishing attack. August 4, 2021: A marketing company, OneMoreLead, has exposed the personal records of126 million individuals through an unsecured database posted online. Data accessed in the breach included travel details email addresses as well as the complete credit card details of 2,208 customers. November 22, 2021: The restaurant chain, California Pizza Kitchen (CPK), revealed a data breach that exposed the personal details of over 100,000 current and former employees. The breach was disclosed in May 2014, after a month-long investigation by eBay. The following data was compromised in the cyberattack: At the time of writing this, it is unknown whether the compromised credit card numbers were complete or hashed. This exposure impacted 92% of the total LinkedIn user base of 756 million users. It was also the second notable phishing scheme the company has suffered in recent years. A security researcher discovered a file on a private server containing email addresses and encrypted passwords. that 567,000 card numbers could have been compromised. But the remaining passwords hashed with SHA-512 could not be cracked. Something went wrong while submitting the form. This is a complete guide to preventing third-party data breaches. August 24, 2021: A misconfiguration within Microsoft Power Apps, a Microsoft product, exposed at least 38 million records. "Marriott reported this incident to law enforcement and continues to support their investigation," the company said at the time. The breached database stored the scraped data of over 200 million Facebook, Instagram, and Linkedin users. The breach may have exposed customers' names and credit- and debit-card numbers, as well as their expiration dates. Canva confirmed the incident, notified users, and prompted them to change passwords and reset OAuth tokens. Signet Jewelers also owns Jared The Galleria of Jewelry, which had the same vulnerability as Kay. In June 2013 around 360 million MySpace accounts were compromised by a Russian hacker, but the incident was not publicly disclosed until 2016. At the time, the company said it believed only customers who shopped on and purchased items from the US version of Adidas.com could have been affected by the breach. Mimecast is a cloud-based email management service that provides email security services for Microsoft 365 accounts. This figure had increased by 37 . Parlers Verified Citizens, or users who had verified their identity by uploading their drivers license or other government-issued photo ID, were also exposed. Objective measure of your security posture, Integrate UpGuard with your existing tools. A dump of 91 million accounts from Rambler ("Russian Yahoo") was traded online containing usernames (that form part of a Rambler email) and plain text passwords. A report published by cybersecurity firm Shape Security showed that 80-90% of the people who log in to a retailer's e-commerce site are hackers using stolen data. Mens clothing store Bonobos suffered a data breach in 2021 after a cybercriminal compromised its backup server containing customer data. Directly accessible data for 170 industries from 50 countries and over 1 million facts: Get quick analyses with our professional research service. 5,000 brands of furniture, lighting, cookware, and more. Even Trezor marveled at the sophistication of this phishing attack. The numbers were published in the agency's . This lethal combination meant that anybody with knowledge of the server IP address could access the leaked sensitive data, and thats exactly what happened. We continue to see a surge in the same, moretraditional and regulated, group of industries as we move through 2021. Estimates of the amount of affected customers were not released, but it could number in the millions. Learn why security and risk management teams have adopted security ratings in this post. The records exposed included private conversations between adult dating site members as well as the following Personally Identifiable Information: Besides the personal information of website members, this data breach also exposed many scam dating websites with fabricated female profiles.. Antheus Tecnologia, a Brazilian biometrics company specializing in the development of fingerprint identification systems, suffered a breach to its server which could potentially expose 76,000 unique fingerprint records. The breaches occurred over several occasions ranging from July 2005 to January 2007. In June 2012, LinkedIn disclosed a data breach had occurred, but password-reset notifications at the time indicated that only 6.5 million user accounts had been affected. Wayfair reported fourth-quarter sales that came up short of expectations. Facebook saw 214 million records breached via an unsecured database. Darden estimatesthat 567,000 card numbers could have been compromised. July 12, 2021:The fashion retailer,Guess, notified an undisclosed number of customers of a data breach following a ransomware attack that resulted in a data breach. A highly sophisticated cyber attack breached exposed the data of 9 million easyJet customers. The FriendFinder Network includes websites like Adult Friend Finder, Penthouse.com, Cams.com, iCams.com, and Stripshow.com. It was fixed for past orders in December. customersshopping online at Macys.com and Bloomingdales.com. When clicked, this link directed users to a malicious website almost indistinguishable from Trezors website. Statista assumes no The number 267 million will ring bells when it comes to Facebook data breaches. Some are so advanced, they can barely be identified by the companys being falsely represented in the email. During the third quarter of 2022, approximately 15 million data records were exposed worldwide through data breaches. The leaked database from the audio chat social network includesuser ID, name, photo URL, username, Twitter handle,Instagram handle, number of followers, number of people followed by the user, and account creation date all of which the company claims is public information. Macy's said in a statement: "We have investigated the matter thoroughly, addressed the cause and, as a precaution, have implemented additional security measures. https://t.co/ysGCPZm5U3 pic.twitter.com/nM0Fu4GDY8. The accessed data also contained comprehensive voter analysis based on Reddit post activity which could be used to predict how somebody would vote on a particular issue. Quora, a popular site for Q&A suffered a data breach in 2018 exposed the personal data of up to 100 million users.The types of leaked data included personal information such as names, email addresses, encrypted passwords, user accounts linked to Quora and public questions and answers posted by users. However, the discovery was not made until 2018. Overview and forecasts on trending topics, Industry and market insights and forecasts, Key figures and rankings about companies and products, Consumer and brand insights and preferences in various industries, Detailed information about political and social topics, All key figures about countries and regions, Market forecast and expert KPIs for 600+ segments in 150+ countries, Insights on consumer attitudes and behavior worldwide, Business information on 60m+ public and private companies, Detailed information for 35,000+ online stores and marketplaces. How UpGuard helps healthcare industry with security best practices. The issue was fixed in November for orders going forward. US-based retailer, Neiman Marcus, has confirmed in a statement that an unauthorized party can access to sensitive customer information including: The breach impacted almost 3.1 million payment and virtual gift cards, of which more than 85% were either expired or no longer valid. In 2021, it has struggled to maintain the same volume. In a statement online, the company said that it didn't believe that other payments made in its grocery stores, drugstores, or convenience stores had been impacted. Employee login information was first accessed from malware that was installed internally. A misconfigured AWS bucket led to the compromise of 23 million files belonging to the Turkish airline company Pegasus Airlines. In addition, the hackers were able to access Uber's GitHub account, where they found Uber's Amazon Web Services credentials. MeetiMindful, a dating app focusing on the mindful community, was breached by a well-known hacker by the name of ShinyHunters. Cambridge Analytica acquired data from Aleksandr Kogan, a data scientist at Cambridge University, who harvested it using an app called "This Is Your Digital Life". Key Points. August 13, 2021: Cybersecurity researchers found an unsecured database containing over 3 million personal records of members belonging to a senior living review site, SeniorAdvisor. January 28, 2021: Through a targeted attack on retail employees of U.S. Cellular, the fourth-largest wireless carrier in the U.S., hackers were able to scam employees into downloading malicious software onto company computers. While Under Armour's store systems and online store weren't affected, the retailer confirmed in March 2018 that data from its MyFitnessPal app was accessed by an "unauthorized party.". Yahoo forced all affected users to change passwords and to reenter any unencrypted security questions and answers to re-encrypt them. Learn more about the latest issues in cybersecurity.