Phishing

Qantas Airways Customer Data Breach (June 2025)

An attacker socially engineered an overseas contact-centre agent into authorizing an attacker-controlled data-extraction application against the agent’s legitimate CRM access. Approximately 5.7 million unique Qantas customer records were affected, including names, email addresses, Frequent Flyer information and, for subsets, addresses, dates of birth, phone numbers, gender and meal preferences. Qantas said passwords, PINs, payment, financial, passport and Frequent Flyer login data were not accessed. The initial intruder attribution was not confirmed; later reporting identified Scattered Lapsus$ Hunters as the collective that reportedly published some records after extortion activity.

Discord Data Breach March 2023

Prevented by: HSF

In March 2023, a data breach occurred at Discord due to security vulnerabilities at a third-party service provider, compromising sensitive personal information of approximately 180 users including names and driver’s license numbers. The breach was facilitated through unauthorized access, likely achieved via compromised credentials due to phishing or social engineering. No specific threat actors were identified in the report.

MailChimp January 2023 Data Breach

Prevented by: HSF

In January 2023, MailChimp experienced a data breach caused by a social engineering attack, allowing unauthorized access to internal customer support tools. The breach affected 133 customer accounts, exposing names, store web addresses, and email addresses, while passwords and financial data remained secure. The attack involved unidentified individuals exploiting employee credentials, revealing vulnerabilities in phishing defenses.

Activision HR Data Breach 2023

Prevented by: HSF

In December 2022, a data breach occurred at Activision due to an SMS phishing attack targeting an HR employee. The breach resulted in unauthorized access to sensitive employee data, including names, phone numbers, job titles, and email addresses. Approximately 19,444 records were compromised, with no known breach of game source codes or player information. The attack underscores the risks of social engineering and highlights vulnerabilities in employee cybersecurity awareness.

Twitter 2020 Data Breach Incident

Prevented by: HSF

In July 2020, a 17-year-old hacker and his accomplices compromised Twitter’s internal systems through social engineering, taking control of approximately 130 high-profile accounts. These accounts were used to perpetrate a Bitcoin scam that led to financial losses of over $117,000. The attack highlighted significant vulnerabilities in Twitter’s protection against social engineering and demonstrated the persistent risk of insider threats.

Norsk Hydro Ransomware Attack - March 2019

Prevented by: HSF, PEC

In March 2019, Norsk Hydro, one of the world’s largest aluminum producers, was hit by the LockerGoga ransomware attack. This incident caused significant operational disruptions and financial losses due to the encryption of critical systems and manual operation deployments. The attack exploited Active Directory vulnerabilities, although the exact perpetrators remain unidentified.

Anthem Data Breach Incident Analysis

Prevented by: PEC, EGR · Contained by: HSF

The Anthem Data Breach in 2015 exposed approximately 78.8 million records, including sensitive Personal Identifiable Information (PII) such as names, birthdates, medical IDs, and Social Security numbers. The breach was executed via a phishing campaign linked to a state-sponsored group, reportedly associated with Chinese cyberespionage activities. The attackers utilized sophisticated malware including Mivast and Sakula to infiltrate the network and execute data exfiltration without detection.

JPMorgan Chase Data Breach

Prevented by: HSF, EGR

In June 2014, a data breach at JPMorgan Chase compromised the accounts of over 76 million households and 7 million small businesses. The attackers accessed names, addresses, phone numbers, and email addresses, leveraging phishing and exploiting network vulnerabilities. The breach has been linked to cybercriminals Gery Shalon, Ziv Orenstein, and Joshua Aaron, emphasizing gaps in network security and authentication procedures.

eBay Data Breach Analysis

Prevented by: HSF, EGR

In early 2014, eBay experienced a significant data breach affecting approximately 145 million user records. The compromised data included names, encrypted passwords, email addresses, physical addresses, phone numbers, and birth dates. Cyber attackers used stolen employee credentials, likely acquired through sophisticated phishing tactics, to gain unauthorized access to eBay’s network. While the encrypted passwords were compromised, PayPal’s financial information remained secure due to separate storage protocols.

Target Data Breach 2013

Prevented by: HSF, PEC, EGR

The Target data breach of 2013 exposed approximately 110 million customer records, including 40 million credit and debit card numbers and 70 million sets of personal data. The breach occurred when attackers gained unauthorized access through compromised credentials from a third-party vendor, using RAM scraping malware to extract data from point-of-sale systems. This incident highlights significant security vulnerabilities in vendor management and network segmentation.