Section / 76 analyses / page 7 of 8
Explore our collection of data breach case studies and learn from past incidents to improve your organization’s security posture.
HSF · PEC · EGR · SCA — filled where the invariant would have prevented or contained the breach
In a 2015 incident, the Australian Immigration Department inadvertently exposed the sensitive personal details of G20 world leaders due to an email autofill error. The breach involved the accidental email of names, birth dates, passport numbers, and visa details to an unintended recipient, raising potential diplomatic concerns despite low risk due to the recipient’s prompt deletion of the email.
Prevented by: HSF, EGR
In June 2014, a data breach at JPMorgan Chase compromised the accounts of over 76 million households and 7 million small businesses. The attackers accessed names, addresses, phone numbers, and email addresses, leveraging phishing and exploiting network vulnerabilities. The breach has been linked to cybercriminals Gery Shalon, Ziv Orenstein, and Joshua Aaron, emphasizing gaps in network security and authentication procedures.
In 2014, Uber experienced a data breach impacting approximately 50,000 individuals, exposing personal information such as names and driver’s license numbers. Unauthorized access was facilitated through a publicly exposed AWS access key on GitHub, underscoring critical flaws in credential management and cloud security. No specific threat actors were identified, but the incident highlighted significant vulnerabilities in Uber’s data protection practices.
Prevented by: HSF, PEC, EGR
The Home Depot data breach, occurring in April 2014, resulted in the theft of over 56 million payment card records through custom-built malware targeting point-of-sale systems across the US and Canada. Organized cybercriminal groups deployed POS-scraping malware using stolen vendor credentials, exfiltrating high volumes of financial data. This incident highlights significant vulnerabilities in third-party access management and the effectiveness of traditional security measures against advanced threats.
Prevented by: HSF, EGR
In early 2014, eBay experienced a significant data breach affecting approximately 145 million user records. The compromised data included names, encrypted passwords, email addresses, physical addresses, phone numbers, and birth dates. Cyber attackers used stolen employee credentials, likely acquired through sophisticated phishing tactics, to gain unauthorized access to eBay’s network. While the encrypted passwords were compromised, PayPal’s financial information remained secure due to separate storage protocols.
Prevented by: HSF, PEC, EGR
The Target data breach of 2013 exposed approximately 110 million customer records, including 40 million credit and debit card numbers and 70 million sets of personal data. The breach occurred when attackers gained unauthorized access through compromised credentials from a third-party vendor, using RAM scraping malware to extract data from point-of-sale systems. This incident highlights significant security vulnerabilities in vendor management and network segmentation.
Prevented by: EGR
In October 2013, Adobe suffered a significant data breach compromising 153 million user records, including encrypted credit card information and user account details such as usernames and email addresses. The breach, one of the largest in cybersecurity history, was executed by exploiting vulnerabilities in Adobe’s systems, notably through outdated encryption practices and unpatched ColdFusion servers. The attack was attributed to financially motivated cybercriminals, likely from Eastern Europe or Russia, aiming to sell the stolen data on the black market.
In October 2013, a Vietnamese threat actor accessed Court Ventures’ database, compromising approximately 200 million personal records including Social Security numbers and credit card details. The breach occurred through exploitation of data-sharing vulnerabilities and inadequate verification processes, highlighting a major security lapse in third-party partnerships.
Prevented by: HSF, PEC, EGR
In August 2013, Yahoo suffered one of the largest data breaches in history, compromising the account information of approximately 3 billion users. The exposed data included usernames, email addresses, telephone numbers, hashed passwords using MD5, and both encrypted and unencrypted security questions and answers. The attack was attributed to state-sponsored actors from Russian intelligence, highlighting a significant cyber-espionage operation.
In June 2013, over 360 million user accounts on MySpace were compromised, exposing usernames, email addresses, and passwords due to inadequate security practices. The passwords were stored using weak SHA-1 hashes without salting, making them vulnerable to cracking. A Russian hacker known as “Peace” was linked to this major breach. MySpace subsequently improved its security by adopting double-salted hashing techniques.
No analysis on this page is scored 0.5 or better for . That invariant’s own page lists every analysis in the corpus that is.
