What is a Data Breach?

A data breach is a security incident where sensitive information is copied, transmitted, viewed, stolen or accessed by an unauthorized individual.

Data breaches can involve financial information like credit card numbers or bank account details, protected health information (PHI), personally identifiable information (PII), trade secrets or intellectual property. Data breaches can also occur when data leaks and cloud leaks are discovered and exploited by cybercriminals.

Learn how to prevent costly data breaches. Download the free guide >

Why Do Data Breaches Occur?

Cybercrime is a profitable industry that continues to grow. Part of this is due to the distributed nature of the Internet and the ability for cybercriminals to attack targets outside of their jurisdiction, making policing it extremely difficult. Cybercriminals seek out personally identifiable information (PII) to steal money, identities, or sell over the dark web.

There are 8 common ways a data breach can happen.

1. Exploiting System Vulnerabilities

‍An exploit is a type of cyber attack that takes advantage of software bugs or vulnerabilities to gain unauthorized access to a system or its data. Vulnerabilities are found by criminals and cybersecurity researchers alike and it's often a race to see who can find them first. Cybercriminals want to find vulnerabilities to exploit and install malware or ransomware like WannaCry. Researchers want to find and report vulnerabilities to hardware and software manufacturers to have them patched. Operating systems, internet browsers and applications like Microsoft Office are all targets for potential exploits. Cybercriminals may even package up multiple exploits into automated exploit kits to make it simple for criminals with no technical knowledge to take advantage of common vulnerabilities.

2. SQL Injection (SQLI)

‍An SQL injection is a form of cyber attack that exploits a weakness in an SQL database of an insecure website to get the website to give access to information in its database without authorized access. SQLI attacks are unsophisticated and require minimal technical knowledge. Like automated exploit kits, cybercriminals often automate SQL injections.‍

3. Spyware

Spyware is malware that infects your computer or network to steal personal information, Internet usage or any other sensitive data it can acquire. You might install spyware by downloading an email attachment or by what seems to a benign application (bundleware). Alternatively, spyware can be installed on your computer as a secondary infection from a Trojan horse. Once spyware is installed, all your data is send back to the command and control servers run by the cybercriminals.

4. Phishing

‍Phishing attacks are a form of social engineering that aim to manipulate emotions or trick you into revealing sensitive information like usernames or passwords. A typical phishing attack is a spoofed (fake) email that looks like it's coming from the CEO of the company you work for. The email will contain aggressive or demanding language and require an action like logging into a web page, verifying a payment or making a purchase. Clicking any links in the email or downloading any attachments could result in your login credentials being stolen or installation of spyware in a malware attack as mentioned above. SMS and social media attacks are becoming increasingly common too. Another example is offering a free credit check to try gain access to personally identifiable information (PII).

5. Insecure Passwords

‍Passwords that are easy to guess, such as dictionary words or common passwords, make it easy for cybercriminals to gain access to sensitive information. Your organization should enforce secure passwords and multifactor authentication for any systems that contain sensitive information. To learn more about what makes a password secure, see our password security checklist.

6. Broken or Misconfigured Access Controls

‍Even the best passwords and cybersecurity can be undone by poor implementation of access controls. For example, your organization may enforce secure passwords and two-factor authentication but have a poorly configure S3 bucket that is open to anyone on the Internet without a password. Check your S3 permissions or someone else will. If you're not secure by design, a cybercriminal using a few Google searches could find misconfigured folders and steal data. Think of it as having a house with the best security system and an open window. You're asking for a cyber attack.

7. Physical Theft

‍Criminals may steal your computer, smartphone or hard drive to gain access to your sensitive data that is stored unencrypted.

8. Third-Party Vendor Breaches

‍Criminals can target third-party business partners or service providers to gain access to large organizations who may have sophisticated cybersecurity standards internally but a poor third-party risk management framework.

What are the Consequences of a Data Breach?

Many countries have passed data breach notification laws, requiring companies to inform customers and remediate breaches when they occur.

Data breaches can result in identity theft (such as full names, Social Security numbers and dates of birth), loss of sensitive information (credit reports or other credit monitoring) or other sensitive data (phone numbers, social media credentials).

It is difficult to obtain information on the direct and indirect cost of poor data security that results in a data breach. And it may seem that stories of massive data breaches pop up in the news frequently, likely due to new data breach notification requirements.

This doesn't mean that the reputational damage of even a small data breach containing sensitive user data is decreasing. If anything, the reputational impact of data breaches is increasing.

This, paired with increased outsourcing of core business functions in and outside of financial services, has increased every organization's need to manage cybersecurity risk and their need for third-party risk management frameworks, cybersecurity risk assessments and a better organizational understanding of information security.

Planning for potential data breaches is now part of any good organization's information risk management strategy and leaders must educate their employees about the differences between cybersecurity and information security.

As the trend toward outsourcing continues and more information moves to the digital world, cyberattacks will become more and more common.

Does it Matter if My Encrypted Data is Stolen?

Yes. After a data breach, you may want to assure your customers that it doesn't matter, the data was encrypted. This isn't necessarily true and here's why. Many companies use a basic form of password encryption: unsalted SHA1 hashing.

A password encrypted with SHA1 will always hash into the same string of characters, making them easy to guess. For example, password1 will always hash to "E38AD214943DAAD1D64C102FAEC29DE4AFE9DA3D".

This is another reason why using a weak password is a bad idea. Cyber criminals can check a list of stolen, hashed passwords against a list of known hashed passwords and decrypt the password easily.

What Do Cybercriminals Do With Data they Gain Access to?

Depending on the type of data and its value, stolen data can end up in a variety of places and uses. Personally identifiable information (PII) typically ends up on the dark web for sale. The dark web is not indexed by search engines and is used to by criminals to traffic illegal goods like drugs, guns, pornography and personal data. There are marketplaces that specialize in selling large batches of personal information gathered from various data breaches that are both known and unknown.

Even if you change your password after a data breach, cybercriminals often use old login credentials to trick you into thinking the account has been hack and use social engineering methods like phishing to gain access to the new login credentials.

If you reuse your password across sites, you are exposing yourself to danger because a data breach on any of the sites you use could result in other accounts being compromised. Cybercriminals use your stolen login from one site to hack into your account on another site, this is a cyber attack known as credential stuffing. The usernames and passwords obtained from one data breach will automatically be used to send login requests to other popular sites.

What are the Biggest Data Breaches?

Here are the 29 biggest data breaches in history by number of accounts affected.

1. Yahoo - 3 billion

Yahoo disclosed that a breach in August 2013 by a group of hackers had compromised 1 billion accounts. In this instance, security questions and answers were also compromised, increasing the risk of identity theft. The breach was first reported by Yahoo on December 14, 2016, and forced all affected users to change passwords, and to reenter any unencrypted security questions and answers to make them encrypted in the future.

2. Aadhaar - 1.1 billion

In March of 2018, it became public that the personal information of more than a billion Indian citizens stored in the world’s largest biometric database could be bought online.

3. Verifications.io - 763 million

In February 2019, email address validation service verifications.io exposed 763 million unique email addresses in a MongoDB instance that was left publicly facing with no password. Many records also included names, phone numbers, IP addresses, dates of birth and genders.

4. Yahoo - 500 million

Yahoo believed that a "state-sponsored actor" was behind this initial cyberattack in 2014. The stolen data included personal information such as names, email addresses, phone numbers, hashed passwords, birth dates, and security questions and answers, some of which were unencrypted.

5. Marriott/Starwood - 500 million

In November 2018, Marriott International announced that hackers had stolen data about approximately 500 million Starwood hotel customers. The attackers had gained unauthorized access to the Starwood system back in 2014 and remained in the system after Marriott acquired Starwood in 2016. However, the discovery was not made until 2018.

6. Adult Friend Finder - 412.2 million

In October 2016, hackers collected 20 years of data on six databases that included names, email addresses and passwords for The FriendFinder Network. The FriendFinder Network includes websites like Adult Friend Finder, Penthouse.com, Cams.com, iCams.com and Stripshow.com.

7. MySpace - 360 million

In June 2013 around 360 million accounts were compromised by a Russian hacker, but the incident was not publicly disclosed until 2016. The information that was leaked included account information such as the owner’s listed name, username, and birthdate.

8. Exactis - 340 million

In June of 2018, Florida-based marketing and data aggregation firm Exactis exposed a database containing nearly 340 million records on a publicly accessible server. The breach exposed highly personal information such as people's phone numbers, home and email addresses, interests and the number, age and gender of their children.

9. Twitter - 330 million

In May of 2018, social media giant Twitter notified users of a glitch that stored passwords unmasked in an internal log, making all user passwords accessible to the internal network. Twitter told its 330 million users to change their passwords but the company said it fixed the bug and that there was no indication of a breach or misuse, but encouraged the password update as a precaution.

10. NetEase - 234 million

In October 2015, NetEase (located at 163.com) was reported to suffered from a data breach that impacted hundreds of millions of subscribers. While there is evidence to say that the data is legitimate (many users confirmed their passwords where in the data), it is difficult to verify emphatically.

11. LinkedIn - 165 million

In June 2012, Linkedin disclosed a data breach had occurred, but password-reset notifications at the time indicated that only 6.5 million user accounts had been affected. LinkedIn never confirmed the actual number, and in 2016, we learned why: a whopping 165 million user accounts had been compromised, including 117 million passwords that had been hashed but not "salted" with random data to make them harder to reverse.

12. Dubsmash - 162 million

In December 2018, Dubmash suffered a data breach that exposed 162 million unique email addresses, usernames and DBKDF2 password hashes.

13. Adobe - 152 million

In October 2013, 153 million Adobe accounts were breached. The data breach contained an internal ID, username, email, encrypted password and password hint in plain text.

14. MyFitnessPal - 150 million

In February 2018, the diet and exercise app MyFitnessPal (owned by Under Armour) suffered a data breach, exposing 144 million unique email addresses, IP addresses and login credentials such as usernames and passwords stored as SHA-1 and bcrypt hashes (the former for earlier accounts, the latter for newer accounts).

15. Equifax - 148 million

In September 2017, Equifax, one of the three largest consumer credit reporting agencies in the United States, announced that its systems had been breached and the sensitive personal data of 148 million Americans had been compromised.

16. eBay - 145 million

Between February and March 2014, eBay was the victim of a breach of encrypted passwords, which resulted in asking all of its 145 million users to reset their password.

17. Canva - 137 million

In May 2019, online graphic design tool Canva suffered a data breach that impacted 137 million users.

18. Apollo - 126 million

In July 2018, Apollo left a database containing billions of data points publicly exposed. A subset of the data was sent to Have I Been Pwned which had 126 million unique email addresses.

19. Badoo - 112 million

The breach contained 112 million unique email addresses and PII like names, birthdates and passwords stored as MD5 hashes.

20. Evite - 101 million

The exposed data included 101 million unique email addresses, as well as phone numbers, names, physical addresses, dates of birth, genders and passwords stored in plain text.

21. Quora - 100 million

Quora, a popular site for Q&A suffered a data breach in 2018 exposed the personal data of up to 100 million users.

22. VK - 93 million

Russian social media site VK was hacked and exposed 93 million names, phone numbers, email addresses and plain text passwords.

23. MyHeritage - 92 million

MyHeritage, a genealogical service website was compromised, affecting more than 92 million user accounts.

24. Youku - 92 million

Youku a chinese video service exposed 92 million unique user accounts and MD5 password hashes.

25. Rambler - 91 million

A dump of 91 million accounts from Rambler ("Russian Yahoo") was traded online containing usernames (that form part of a Rambler email) and plain text passwords.

26. Facebook - 87 million

Though a slightly different type of data breach as the information was not stolen from Facebook, the incident that affected 87 million Facebook accounts represented the use of personal information for purposes that the affected users did not appreciate.

27. Dailymotion - 85 million

In October 2016, Dailymotion a video sharing platform exposed more than 85 million user accounts including emails, usernames and bcrypt hashes of passwords.

28. Dropbox - 69 million

In mid 2012, Dropbox suffered a data breach which exposed 68 million records that contained email addresses and salted hashes of passwords (half SHA1, half bcrypt).

29. tumblr - 66 million

In February 2013, tumblr suffered a data breach that exposed 65 million accounts. The breach included email addresses and salted SHA1 password hashes.

Notable Data Breaches

What are Data Breach Laws?

It feels like every news cycle has more data breaches. Are data breaches occurring more? Or are we just hearing about them more?

It's likely that the increasing appearance of data breaches in the news is being driven by growing regulation around the world about how data breaches are communicated.

There are also a number of industry guidelines and government compliance regulations that mandate strict control of sensitive and personal data to avoid data breaches. For corporations, the Payment Card Industry Data Security Standard (PCI DSS) dictates who can handle and use personally identifiable information (PII), such as credit card numbers or names and addresses.

In healthcare, the Health Insurance Portability and Accountability Act (HIPAA) regulates who can see and use personal health information (PHI) such as a patient names, dates of birth, Social Security Numbers (SSNs) and healthcare treatments. HIPAA also has specific requirements for reporting healthcare related data breaches in its Health Information Technology for Economic and Clinical Health (HITECH) Act.

With the introduction of the General Data Protection Regulation (GDPR) by the European Parliament and Council in 2016, the need to respond to information security breaches has become a regulatory requirement for any business operating within the EU. Companies are now required to:

provide data breach notifications
appoint a data-protection officer
require user consent for data processing
anonymize data for privacy

In the United States, there is no national law overseeing data breach disclosures. However, as of 2018, all 50 US states have data breach laws in some form. There are a few commonalities including:

The requirement to notify those affect as soon as possible
Let the government know as soon as possible
Pay some sort of fine

California was the first state to regulate data breach disclosures in 2003, requiring persons or businesses to notify those affected "without reasonable delay" and "immediately following discovery". Victims can sue for up to $750 and companies can be fined up to $7,500 per victim.

New York's Office of Information Technology Services says that "State entities and persons or businesses conducting business in New York who own or license computerized data which includes private information must disclose any breach of the data to New York residents whose private information was exposed."

What Should I do if My Organization's Data is Stolen?

Large multinational enterprises and small businesses can suffer from data breaches whether from cybercriminals or from accidental data breaches that are caused by misconfigured cloud services or failing to implement proper access controls such as password requirements for public-facing web services or applications. Organizations should have an incident response plan that is implemented when a breach does occur to identify, contain and quantify the breach.

Responding to a breach well is the most important thing, here's what you need to do:

1. Ensure the Breach has Stopped

Before you do anything, you need to make sure the breach has stopped by identifying the affected parts of your computer system and isolating them. You're going to need all the information on those servers to understand what data was compromised, you need to be logging everything.

2. Determine Scope of Breach

‍You need to know what data has been exposed. This means an exhaustive audit of what data was accessed and when. To determine the scope of the breach simply read what data was accessed or modified. Ideally, you will have audit logs and backups to compare what has changed on your affected server. If you don't have logs or don't think you can trust them, look for an expert on the data in your organization and ask them to check the data to try determine if it is accurate.

3. Inform Customers

‍You need to communicate to those affected that their data was exposed. As you know from above, there are legal reasons to inform your customers but quick, quality communication can also help save your organization from potential reputational damage. Give your customers the steps required to secure their accounts (or personal details) where possible.

4. Implement Solutions to Prevent Future Breaches

To regain the trust of your customers you need to ensure the breach won't happen again. The SANS Institute has security guidelines about how to prevent breaches and the National Institute of Standards and Technology (NIST) publishes a set of standards, guidelines and best practices to manage cybersecurity risk in their Cybersecurity Framework.

Additional measures like well-written and widely understood security policies for employees, third-party vendors and leadership can help to educate and reduce the chance of accidental data exposure. The principle of least privilege (POLP) gives employees the bare minimum permissions need to perform their duties (and no more).

Deploying an attack surface management solution will identify all vulnerabilities, both internally and throughout the vendor network. By addressing ecosystem vulnerabilities before they're exploited by cybercriminals, the impact of data breach attempts will be significantly minimized.

What Should I do if My Data is Stolen in a Data Breach?

To protect yourself when if your data is exposed or stolen, there are a few steps you can take to protect yourself, your money and your personal information including:

1. Changing Your Password

‍If a site you use has been breached, change your password to a unique password for each online account. If you find keeping track of these passwords difficult, you can use a password manager like 1Password.

2. Monitor Your Bank aAccount and Other Financial Accounts

‍Check your bank account on a regular basis for unfamiliar activity.

3. Check Your Credit Report

‍Do so regularly to ensure that no credit cards are being opened under your name.

4. Take Action

If you see suspicious activity, contact your financial institution or the website that has been affected immediately.

5. Secure Your Phone

‍Your phone can hold a lot of valuable personal information, a simple passcode will prevent it from being accessed if it is ever stolen.

6. Check URLs

‍Even if it looks legit, make sure that the site has a valid SSL certificate (https) that matches the site you're looking to log in to.

7. Check have i been pwned?

‍It's a free service that will let you check if your email address has been included in any known data breaches.

How to Prevent Data Breaches in 2023

There is no one security product or control that can prevent data breaches alone. At a minimum you need common sense security and prevention practices to make a reasonable attempt at reducing data breaches. This includes ongoing protection practices like vulnerability and penetration testing, malware protection, enforcing strong passwords, multifactor authentication and consistently updating hardware and software to patch known vulnerabilities.

These steps will attempt to prevent intrusions into a protected environment and cybersecurity professionals should also encourage strong encryption of sensitive data regardless of if it is stored on-premise or in cloud services.

Organizations should also practice network segmentation, splitting computer networks into subnetworks reducing the impact of an attack if they do gain access to a network while boosting performance.

At UpGuard, we can protect your business from data breaches, identify all of your data leaks, and help you continuously monitor the security posture of all your vendors.

Breach Risk

Vendor Risk

Trust Exchange

Vendor Risk Assessments

Security Questionnaires

Security Ratings

Data Leaks Detection

Reporting & Dashboards

Integrations

Questionnaire AI

Services

Financial Services

Technology

Healthcare

ISO 27001

NIST Cybersecurity Framework

SIG Lite Questionnaire

APRA CPS 230 Compliance

What is Cyber Threat Detection and Response?

Human Factors in Cybersecurity in 2024

Cast a Wider Net: UpGuard Now Scans 5x More Sources

Blog

Breaches

eBooks, Reports, & more

Events