The Most Recent High-Profile Company Data Breaches
The rate at which companies are experiencing cyber security breaches is alarming and the damage can be detrimental if you don’t have an incident response plan in place.
Cyber attacks are an ever-growing threat for businesses of all sizes and criminals methods are only becoming more sophisticated. The recent high-profile attacks target healthcare, finance, retail, government, manufacturing, and energy.
The threat landscape has evolved significantly over the past few years. According to projections, cybercrime is forecast to cost the global economy $10.5 trillion by 2025, reflecting a 15% increase year on year.
Small-medium-sized businesses are commonly targeted, but there are steps you can take to help you stay ahead of the curve, be cyber smart, and better prepare your security strategy.
Businesses have never been more vulnerable, and even large enterprises with substantial cybersecurity defenses can fall victim. Be prepared to fight back.
Top 6 Recent High-Profile Company Data Breaches
1. Google Fi: February 2023
If you are a Google Fi user, be extra careful of suspicious messages in 2023.
Google Fi is the most recent high-profile data breach, but it came as a consequence of the T-Mobile data breach that happened earlier in 2023 (discussed below).
Since Google doesn’t have it’s own network infrastructure and had to piggyback on T-Mobile’s network, they were affected by their massive data breach, compromising their customers’ phone numbers.
Although it’s simply phone numbers, there is a lot cybercriminals can do with that kind of customer information, including phishing attacks intended to deceive users into clicking links that allow the hackers access to other info.
2. T-Mobile: January 2023
In early January 2023, T-Mobile discovered that a malicious actor gained access to their systems in November last year and stole personal information, like names, emails, and birthdays, from over 37 million customers. Once they identified the data breach, they were able to track down the source and contain it within a day.
T-Mobile claims they may “incur significant expenses” from this data breach, which will be on top of the $350 million they agreed to pay customers in a settlement related to an August 2021 data breach.
Not only has T-Mobile lost hundreds of millions of dollars because of their poor security, but they have also lost customers’ trust after multiple breaches of personal information.
3. MailChimp: January 2023
This is MailChimp’s first attack of 2023, but they also had data breaches in April and August of 2022.
MailChimp, the email marketing platform, alerted customers that they had suffered a data breach due to a social engineering attack that allowed unauthorized users into an internal customer support tool.
The hackers gained access to employee information and credentials, but the company has since identified and suspended those accounts.
In response to the data breach, MailChimp has said “Our investigation into the matter is ongoing, and includes identifying measures to further protect our platform”, according to Bleeping Computer.
It’s important to know what to do after a data breach in order to stop hacking attempts before they compromise information multiple times, as MailChimp now knows.
4. Norton Life Lock: January 2023
Norton Life Lock sent a notice to their customers in mid-January that over 6,000 of their customer accounts had been breached in recent weeks due to a “stuffing” attack.
Stuffing attacks are when previously compromised passwords are used to hack in to accounts that use a shared password, another reason why multi-factor authentication is so important.
Gen Digital, Norton Life Lock’s parent company, sent the notice to accounts they believe could have been compromised and recommended changing passwords and enabling multi-factor authentication.
5. Uber: December 2022
Uber announced on December 12th, 2022 that a hacker under the pseudonym “UberLeaks” gained access to 70,000+ Uber employees data and was posting stolen corporate data.
They believe this data breach occurred because of a third-party vendor, Teqtivity (a tech asset management company) who had their mobile device management compromised.
This attack was unrelated to another data breach they suffered in 2022 when they discovered they were hacked in mid-September after the hacker announced in the companies Slack organization “I am a hacker and Uber has suffered a data breach” followed by several emojis.
This caused the company to shut down its internal messaging service and engineering systems in order to get to the bottom of the incident.
The hacker also claimed it could hack into several of the company’s databases, including messaging data. Uber got in touch with law enforcement and found out the hacker compromised an employee’s account.
Uber had dealt with a cyber attack in the past and didn’t report it, which led to a legal battle and thousands of dollars in fees. After another big data breach in 2022, they may need to spend more money to upgrade their cyber security.
6. MediBank: October 2022
Health insurer MediBank revealed on 10/25/2022 that almost 4 million of their customers’ data had been exposed to a hacker.
The Australian health insurer said the personal information that could have been obtained includes name, address, date of birth, and even insurance card numbers.
In order to make things right, MediBank said it would offer compensation to those who were taken advantage of due to their private information being accessed. The estimated cost of this cyber attack to the company is between $25M and $35M.
They have since conducted an investigation and added more network monitoring and determined the hacker is no longer present.
Other Cyber Security Breaches
Hackers may not just be after customer data, but they may breach a company’s cyber security measures in order to steal other important information.
On August 25th, 2022, Last Pass, a password management provider used by over 30 million people, announced that a third-party had been able to infiltrate their network by accessing a compromised developer account.
Although the security of the company had been breached, they stated that they don’t believe any encrypted customer data had been accessed, but rather the user “took portions of source code and some proprietary LastPass technical information.”
This means that no customer data was breached and that Last Pass’s security and encryption measures for their customer’s passwords did its job.
Although this cyber security breach has prompted Last Pass to hire third-party investigators and work towards protecting themselves against more breaches in the future.
Companies With The Most Data Breaches In 2023
Some of the most high-profile company data breaches are notorious for their frequency as well as the damage caused.
Facebook is one of the most popular websites in the world today. However, the company has faced numerous privacy issues over the years.
Their most recent attack occurred in 2021, affecting 533 million users. Before that, Facebook was also hacked in 2018 and 2014, leaving 2.2 billion and 50 million people impacted, respectively.
Yahoo is another infamous victim of back-to-back cybersecurity incidents. The company was hacked in 2013 and 2014, leaving 1 billion and 500 million people affected, respectively. Their most recent attack in 2017 impacted 32 million users.
Other companies that have experienced repeat data breaches in the recent past include Amazon, Twitter, Microsoft, Uber, AOL, Dropbox, eBay, and more.
Why do these companies experience repeat attacks? Here’s a quick overview of three common reasons:
- Old Vulnerabilities: It’s not uncommon for a hacker to leave a secret window that they can use to access a company’s systems again after a successful first attempt. Failing to patch these vulnerabilities can lead to a second attack.
- Human Error: Employees using weak passwords may expose a company’s systems to subsequent attacks. Other common human errors include employees clicking on malicious links and visiting phishing sites. Unless you perform follow-up security training following an initial breach, employees can repeat previous mistakes that leave your business vulnerable.
- Malware: Hackers use malicious software such as viruses, ransomware, Trojans, spyware, adware, etc., to steal confidential information from an organization’s network system. If a company fails to step up monitoring protocols after its first breach, there is nothing to stop repeat attacks from occurring.