Tag / 50 entries / page 2 of 5 / feed available
50 of the 76 analyses in Data Breaches carry this tag.
HSF · PEC · EGR · SCA — filled where the invariant would have prevented or contained the breach
Prevented by: HSF
In December 2023, unauthorized access to U-Haul systems occurred via stolen credentials, affecting approximately 67,000 customers. The breach exposed personal information including names and driver’s license numbers, posing identity theft risks. The precise actors behind the attack remain unidentified, highlighting challenges in credential security.
Prevented by: HSF
In December 2023, a data breach at genetic testing company 23andMe exposed the personal data of approximately 6.9 million users to unauthorized access. The breach, executed through credential stuffing, compromised user profiles and familial connections, leaving sensitive personal data vulnerable. It underscored the need for robust password practices and security measures such as multi-factor authentication.
Prevented by: HSF, PEC · Contained by: EGR
In October 2023, the British Library was targeted by the Rhysida ransomware group, resulting in the encryption and leak of approximately 490,191 files, amounting to 573 GB of data. The breach illustrated vulnerabilities in security protocols due to compromised credentials and the absence of Multi-Factor Authentication (MFA), significantly disrupting library operations and potentially exposing sensitive internal data.
Prevented by: HSF, EGR
In October 2023, the Indian Council of Medical Research experienced a major data breach that led to the exposure of 815 million records, including Aadhaar IDs, passport details, names, phone numbers, and addresses. The data was compromised by a hacker identified as pwn0001, who made the information available for sale on the dark web. The breach involved significant security vulnerabilities, particularly in access controls and encryption practices, indicating a need for improved data protection measures.
In August 2023, DuoLingo suffered a data breach affecting over 2.6 million users due to a data scraping attack exploiting an exposed API. Compromised data included names and email addresses, posing risks for phishing attacks. The attack was carried out by unidentified threat actors utilizing automated scripts to extract data from the vulnerable API.
Contained by: PEC
The June 2023 MOVEit data breach began with the exploitation of a zero-day SQL injection vulnerability (CVE-2023-34362) in the MOVEit Transfer software; over 200 organizations were confirmed affected within the first weeks, a toll that climbed to more than 2,700 organizations and over 95 million individuals as disclosures continued into 2024. The Clop ransomware group was responsible, utilizing web shell deployment and data exfiltration methods to access and steal personal and sensitive information, highlighting substantial risks in application security and third-party systems.
The Tesla Massive Data Breach, revealed in May 2023, involved the unauthorized disclosure of sensitive data by two former employees who leaked approximately 100 gigabytes of personal records and corporate secrets to a German news outlet. This incident compromised personal information including social security numbers, corporate secrets, and sensitive vehicle safety data. The attack vector identified was an insider threat, highlighting significant vulnerabilities in access control and insider management.
In May 2023, Microsoft suffered a data breach conducted by China-based hackers, Storm-0558, who used forged authentication tokens to access customer email accounts. This breach impacted governmental entities, resulting in the unauthorized access and potential exfiltration of approximately 60,000 unclassified emails, emphasizing the breach’s serious national security implications.
Prevented by: PEC, EGR · Contained by: HSF
In January 2023, Yum! Brands, owner of KFC, Taco Bell, and Pizza Hut, experienced a data breach following a ransomware attack. The breach exposed sensitive employee information, including names and Social Security Numbers. While corporate data was compromised, no customer data was initially reported as affected. Unknown cybercriminals were responsible for the attack, which led to temporary closures of restaurants in the UK.
Prevented by: HSF
In March 2023, a data breach occurred at Discord due to security vulnerabilities at a third-party service provider, compromising sensitive personal information of approximately 180 users including names and driver’s license numbers. The breach was facilitated through unauthorized access, likely achieved via compromised credentials due to phishing or social engineering. No specific threat actors were identified in the report.
