Major Breach

Home Depot Data Breach April 2014

Prevented by: HSF, PEC, EGR

The Home Depot data breach, occurring in April 2014, resulted in the theft of over 56 million payment card records through custom-built malware targeting point-of-sale systems across the US and Canada. Organized cybercriminal groups deployed POS-scraping malware using stolen vendor credentials, exfiltrating high volumes of financial data. This incident highlights significant vulnerabilities in third-party access management and the effectiveness of traditional security measures against advanced threats.

eBay Data Breach Analysis

Prevented by: HSF, EGR

In early 2014, eBay experienced a significant data breach affecting approximately 145 million user records. The compromised data included names, encrypted passwords, email addresses, physical addresses, phone numbers, and birth dates. Cyber attackers used stolen employee credentials, likely acquired through sophisticated phishing tactics, to gain unauthorized access to eBay’s network. While the encrypted passwords were compromised, PayPal’s financial information remained secure due to separate storage protocols.

Target Data Breach 2013

Prevented by: HSF, PEC, EGR

The Target data breach of 2013 exposed approximately 110 million customer records, including 40 million credit and debit card numbers and 70 million sets of personal data. The breach occurred when attackers gained unauthorized access through compromised credentials from a third-party vendor, using RAM scraping malware to extract data from point-of-sale systems. This incident highlights significant security vulnerabilities in vendor management and network segmentation.

Adobe 2013 Data Breach

Prevented by: EGR

In October 2013, Adobe suffered a significant data breach compromising 153 million user records, including encrypted credit card information and user account details such as usernames and email addresses. The breach, one of the largest in cybersecurity history, was executed by exploiting vulnerabilities in Adobe’s systems, notably through outdated encryption practices and unpatched ColdFusion servers. The attack was attributed to financially motivated cybercriminals, likely from Eastern Europe or Russia, aiming to sell the stolen data on the black market.

Court Ventures (Experian) Data Breach

In October 2013, a Vietnamese threat actor accessed Court Ventures’ database, compromising approximately 200 million personal records including Social Security numbers and credit card details. The breach occurred through exploitation of data-sharing vulnerabilities and inadequate verification processes, highlighting a major security lapse in third-party partnerships.

MySpace Data Breach

In June 2013, over 360 million user accounts on MySpace were compromised, exposing usernames, email addresses, and passwords due to inadequate security practices. The passwords were stored using weak SHA-1 hashes without salting, making them vulnerable to cracking. A Russian hacker known as “Peace” was linked to this major breach. MySpace subsequently improved its security by adopting double-salted hashing techniques.

Greece Government Data Breach 2012

Prevented by: EGR · Contained by: HSF

In 2012, the Greece government was hacked, exposing 9,000,000 records, including addresses, ID card data, tax ID numbers, and license plate numbers.

LinkedIn Password Breach

Prevented by: HSF, PEC, EGR

The LinkedIn Password Breach in 2012 affected over 117 million user accounts by exposing passwords hashed with the insecure SHA1 algorithm, unsalted. The breach data was subsequently sold on cybercrime forums, with LeakedSource holding a searchable database. The exposure of user credentials posed significant risks of unauthorized account access.

California Department of Child Support Services Data Breach

In 2012, the California Department of Child Support Services experienced a data breach when magnetic tapes were lost in transit, compromising the personal data of 800,000 individuals, including names, addresses, and Social Security numbers. This incident highlighted vulnerabilities in physical media security and the absence of encryption, with no involvement of external threat actors.

Heartland Payment Systems Data Breach

Prevented by: PEC, EGR

The Heartland Payment Systems data breach in 2008 compromised approximately 130 million payment card records. The breach was executed using SQL injection attacks to install malware, capturing sensitive financial data such as credit card numbers over a prolonged period. Albert Gonzalez, a known cybercriminal, was attributed as the architect of this breach. The incident revealed significant vulnerabilities in Heartland’s transaction processes leading to substantial financial and reputational damage.