Tag / 17 entries / page 2 of 2 / feed available
17 of the 76 analyses in Data Breaches carry this tag.
HSF · PEC · EGR · SCA — filled where the invariant would have prevented or contained the breach
In November 2019, Alibaba’s Taobao platform was breached by a developer who scraped 1.1 billion pieces of user data, including usernames and mobile numbers. This incident involved unauthorized web scraping by a threat actor using automated tools to collect sensitive personal information.
In May 2019, First American Financial Corp. suffered a major data breach that exposed approximately 885 million file records due to a security flaw. The breach involved bank account details and mortgage-related documents, which were accessible through unsecured URLs without authentication. The vulnerability was attributed to insufficient security measures, and there were no specific threat actors identified.
In April 2019, Facebook experienced a major data breach exposing the personal information of over 530 million users from two datasets. The breach involved cloud storage misconfiguration and data scraping vulnerabilities, resulting in the leak of phone numbers and account names. The attack did not involve specific threat actors but exploited weaknesses in the Facebook contact importer and third-party AWS storage configurations.
In 2017, a misconfigured Amazon Web Services (AWS) S3 bucket at Deep Root Analytics exposed sensitive data of nearly 200 million U.S. voters. The breach involved personal information such as names, addresses, birth dates, and political affiliations. This incident was primarily due to cloud storage misconfiguration without any evidence of external hacking, highlighting vulnerabilities in data handling practices by third-party vendors.
Contained by: EGR
The 2016 AdultFriendFinder data breach exposed approximately 412 million user accounts due to vulnerabilities in Local File Inclusion (LFI). Compromised data included usernames, email addresses, and passwords, mostly stored in plaintext or hashed with weak SHA-1, making them vulnerable to cracking. While the exact perpetrators remain unidentified, discussions suggest involvement from actors on Russian forums.
In a 2015 incident, the Australian Immigration Department inadvertently exposed the sensitive personal details of G20 world leaders due to an email autofill error. The breach involved the accidental email of names, birth dates, passport numbers, and visa details to an unintended recipient, raising potential diplomatic concerns despite low risk due to the recipient’s prompt deletion of the email.
In 2012, the California Department of Child Support Services experienced a data breach when magnetic tapes were lost in transit, compromising the personal data of 800,000 individuals, including names, addresses, and Social Security numbers. This incident highlighted vulnerabilities in physical media security and the absence of encryption, with no involvement of external threat actors.
