https://securityblueprints.io/tags/data-leak/ Recent content in Data Leak on Security Blueprints Hugo en user@example.com (Niels Provos) user@example.com (Niels Provos) Security Blueprints, LLC Sun, 06 Sep 2026 23:57:44 +0000 https://securityblueprints.io/data-breaches/national-public-data-breach-of-april-2024/ Mon, 01 Apr 2024 00:00:00 +0000user@example.com (Niels Provos) https://securityblueprints.io/data-breaches/national-public-data-breach-of-april-2024/ Executive Summary In April 2024, National Public Data (NPD) became the subject of a significant data breach, compromising sensitive personal information of hundreds of millions of Americans. The breach was attributed to a security oversight, specifically the inadvertent publication of administrative credentials, leading to unauthorized access to NPD’s databases. This event highlights substantial gaps in cybersecurity practices and emphasizes the critical need for robust protection and risk management strategies. Incident Overview Chronological Sequence of Events December 2023 https://securityblueprints.io/data-breaches/23andme-data-breach/ Fri, 01 Dec 2023 00:00:00 +0000user@example.com (Niels Provos) https://securityblueprints.io/data-breaches/23andme-data-breach/ Executive Summary In December 2023, 23andMe, a leader in consumer genetic testing, disclosed a data breach resulting from credential stuffing attacks, compromising the personal data of approximately 6.9 million users. This type of attack utilized stolen credentials from unrelated data breaches, impacting user accounts by exploiting weak password practices. Key Dates Breach Discovery: Initial indications arose on October 4, 2023, with public acknowledgment on October 6, 2023. Formal Disclosure: Comprehensive disclosure of the breach’s details occurred in December 2023. https://securityblueprints.io/data-breaches/real-estate-wealth-network-data-breach/ Fri, 01 Dec 2023 00:00:00 +0000user@example.com (Niels Provos) https://securityblueprints.io/data-breaches/real-estate-wealth-network-data-breach/ Executive Summary The Real Estate Wealth Network (REWN) data breach in December 2023 involved the unauthorized exposure of over 1.5 billion records due to a cloud misconfiguration. This extensive breach was discovered by cybersecurity researcher Jeremiah Fowler on December 20, 2023. Public disclosure followed on December 26, 2023. The breach predominantly exposed personal and property information, posing significant risks such as identity theft and financial fraud. Key Details Breach Date: December 2023 Discovery Date: December 20, 2023 Severity: Exposure of personal data including Social Security numbers and property ownership details Root Cause: Cloud configuration error, an internal oversight Impact Affected Individuals: Millions, including both private citizens and high-profile figures Consequences: Risks of identity theft, financial fraud, harassment, and privacy invasion Response REWN secured the database after the breach was disclosed and plans to conduct a forensic audit to assess potential unauthorized access. https://securityblueprints.io/data-breaches/samsung-data-breach-november-2023/ Mon, 13 Nov 2023 00:00:00 +0000user@example.com (Niels Provos) https://securityblueprints.io/data-breaches/samsung-data-breach-november-2023/ Executive Summary On November 13, 2023, Samsung Electronics detected a data breach originating from a vulnerability in a third-party application. This breach affected customers who made purchases through the Samsung UK online store between July 1, 2019, and June 30, 2020, exposing personal information, including names, phone numbers, postal addresses, and email addresses. Samsung notified affected customers on November 16, 2023. Severity of Impact The breach’s significance lies in the exposure of sensitive personal information, even though financial data and passwords were not compromised. https://securityblueprints.io/data-breaches/tesla-massive-data-breach/ Wed, 10 May 2023 00:00:00 +0000user@example.com (Niels Provos) https://securityblueprints.io/data-breaches/tesla-massive-data-breach/ Executive Summary The Tesla Massive Data Breach, discovered in May 2023, was a significant incident involving the unauthorized disclosure of sensitive data by two former employees to Handelsblatt, a German media outlet. On May 10, 2023, this breach came to light when Handelsblatt informed Tesla of their possession of approximately 100 gigabytes of confidential data, involving over 23,000 internal files (CentralEyes , Hackread ). Severity of Impact The breach impacted over 75,735 individuals, including both current and former employees. https://securityblueprints.io/data-breaches/chatgpt-data-breach/ Mon, 20 Mar 2023 00:00:00 +0000user@example.com (Niels Provos) https://securityblueprints.io/data-breaches/chatgpt-data-breach/ Executive Summary Overview of the Incident In March 2023, OpenAI’s ChatGPT platform experienced a data breach caused by a bug in the open-source library, Redis-py, used by the service. This issue resulted in the exposure of sensitive user data, including names, emails, payment addresses, and partial credit card details (last four digits and expiration dates). The breach was identified on March 20, 2023, during a service outage, revealing private information in error source . https://securityblueprints.io/data-breaches/activision-hr-data-breach-2023/ Sun, 04 Dec 2022 00:00:00 +0000user@example.com (Niels Provos) https://securityblueprints.io/data-breaches/activision-hr-data-breach-2023/ Executive Summary In December 2022, Activision, a leading video game developer, encountered a data breach caused by a sophisticated SMS phishing attack targeting a Human Resources (HR) employee. This breach resulted in unauthorized access to internal data, including employee names, phone numbers, email addresses, job titles, and workplace locations. Despite discrepancies regarding the exact public disclosure date, the breach became widely acknowledged in February 2023, highlighting substantial risks to employee data security [TechCrunch ] [Intrix ]. https://securityblueprints.io/data-breaches/pegasus-airlines-data-exposure/ Tue, 01 Mar 2022 00:00:00 +0000user@example.com (Niels Provos) https://securityblueprints.io/data-breaches/pegasus-airlines-data-exposure/ Executive Summary Incident Overview In March 2022, Pegasus Airlines faced a data exposure due to a misconfiguration in an AWS S3 bucket by a system administrator. This incident led to the exposure of approximately 23 million files, containing Personally Identifiable Information (PII) and critical operational data (source ). Severity of Impact The breach involved 6.5 terabytes of sensitive data, including sensitive operational information, crew identification details, plaintext passwords, secret keys, insurance documents, and safety guidelines. https://securityblueprints.io/data-breaches/linkedin-data-scraping-incident/ Thu, 01 Apr 2021 00:00:00 +0000user@example.com (Niels Provos) https://securityblueprints.io/data-breaches/linkedin-data-scraping-incident/ Executive Summary In April 2021, LinkedIn reported a significant data scraping incident involving approximately 700 million user records, totaling over 93% of its user base. The breach was disclosed in June 2021 after data was discovered being sold on dark web forums by the hacker known as “GOD User TomLiner,” who intended to sell the dataset for an estimated $5,000 to $6,600. Severity of the Impact The breach’s significance lies in the vast volume of exposed personal information, such as full names, email addresses, phone numbers, LinkedIn IDs, and sensitive data like gender, industry, and inferred salaries. https://securityblueprints.io/data-breaches/sina-weibo-data-breach-2020/ Thu, 19 Mar 2020 00:00:00 +0000user@example.com (Niels Provos) https://securityblueprints.io/data-breaches/sina-weibo-data-breach-2020/ Executive Summary In March 2020, Sina Weibo, a leading Chinese microblogging platform, experienced a significant data breach impacting approximately 538 million users. The breach was publicly acknowledged when an attacker leveraged a logic flaw in the Sina Weibo API to access and sell personal user information on the dark web for about USD 250. This breach exposed sensitive details such as real names, usernames, gender, location, and phone numbers for 172 million users, though passwords were not compromised. https://securityblueprints.io/data-breaches/alibaba-taobao-data-breach/ Fri, 01 Nov 2019 00:00:00 +0000user@example.com (Niels Provos) https://securityblueprints.io/data-breaches/alibaba-taobao-data-breach/ Executive Summary In November 2019, Alibaba’s Taobao platform experienced a breach involving unauthorized data scraping activities by a developer. This breach involved collecting 1.1 billion pieces of user data, including usernames and mobile numbers, over several months until discovered in July 2020. Officially acknowledged on June 16, 2021, the breach stands as significant due to its volume and impact. Severity of Impact The breach is one of the largest data leaks recorded, affecting approximately 710 million Taobao users. https://securityblueprints.io/data-breaches/first-american-financial-corp-data-breach/ Fri, 24 May 2019 00:00:00 +0000user@example.com (Niels Provos) https://securityblueprints.io/data-breaches/first-american-financial-corp-data-breach/ Executive Summary In May 2019, a data breach at First American Financial Corp. resulted in the exposure of approximately 885 million file records due to inadequate security measures on their web portal. The breach came to light when a real estate developer discovered the vulnerability, and cybersecurity journalist Brian Krebs publicly disclosed it on May 24, 2019. The exposed records included sensitive financial documents such as bank account numbers, mortgage-related documents, and Social Security numbers, with records dating back to 2003. https://securityblueprints.io/data-breaches/facebook-data-breach-2019/ Mon, 01 Apr 2019 00:00:00 +0000user@example.com (Niels Provos) https://securityblueprints.io/data-breaches/facebook-data-breach-2019/ Executive Summary In April 2019, a significant data breach affected Facebook, exposing the personal information of over 530 million users across 106 countries. The breach involved the improper access and sharing of two datasets, revealing sensitive information such as phone numbers, account names, Facebook ID numbers, and email addresses. The exposure occurred due to the misuse of Facebook’s ‘contact importer’ feature and improperly secured third-party applications hosted on Amazon Web Services (AWS) servers. https://securityblueprints.io/data-breaches/deep-root-analytics-data-breach/ Mon, 12 Jun 2017 00:00:00 +0000user@example.com (Niels Provos) https://securityblueprints.io/data-breaches/deep-root-analytics-data-breach/ Executive Summary In 2017, a data breach at Deep Root Analytics exposed the sensitive information of approximately 198 million U.S. voters. This information, linked to the Republican National Committee (RNC), was leaked due to a misconfigured Amazon Web Services (AWS) S3 bucket, which lacked adequate security settings. The breach included personal information such as names, addresses, birth dates, phone numbers, political affiliations, and predictive modeling data on ethnicities and religious orientations. https://securityblueprints.io/data-breaches/adultfriendfinder-data-breach/ Thu, 20 Oct 2016 00:00:00 +0000user@example.com (Niels Provos) https://securityblueprints.io/data-breaches/adultfriendfinder-data-breach/ Executive Summary The AdultFriendFinder data breach, a significant incident in 2016, compromised approximately 412 million user accounts across platforms under FriendFinder Networks, including AdultFriendFinder.com, Cams.com, and Penthouse.com. This breach unveiled notable security vulnerabilities within the company’s systems. Breach Details The breach occurred in October 2016 when attackers exploited Local File Inclusion (LFI) vulnerabilities within the website’s architecture, enabling unauthorized access to sensitive information. This data was publicly posted on November 13, 2016. https://securityblueprints.io/data-breaches/australian-immigration-department-g20-data-breach/ Fri, 07 Nov 2014 00:00:00 +0000user@example.com (Niels Provos) https://securityblueprints.io/data-breaches/australian-immigration-department-g20-data-breach/ Executive Summary In 2015, the Australian Immigration Department was involved in a data breach releasing sensitive personal details of G20 world leaders due to an administrative error. The error occurred when an employee improperly used the autocomplete function in Microsoft Outlook, resulting in sensitive information being sent to an unintended recipient. This incident compromised data such as passport numbers, visa information, and birth dates of leaders including Barack Obama, Vladimir Putin, and Angela Merkel (ABC News ). https://securityblueprints.io/data-breaches/california-department-of-child-support-services-data-breach/ Mon, 12 Mar 2012 00:00:00 +0000user@example.com (Niels Provos) https://securityblueprints.io/data-breaches/california-department-of-child-support-services-data-breach/ Executive Summary Breach Name: California Department of Child Support Services Breach Date: 2012 Discovery Date: March 12, 2012 Disclosure Date: March 29, 2012 Incident Overview In 2012, the California Department of Child Support Services (DCSS) suffered a data breach due to the loss of magnetic tape cartridges, which occurred during a disaster recovery exercise managed by IBM and Iron Mountain Inc. Between Boulder, Colorado, and Sacramento, California, four of fifteen tapes went missing, containing the sensitive information of approximately 800,000 individuals.